GCVE-1988-2026-0403

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
Title
APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1 macOS Sequoia 15.8.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/149229. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. CoreGraphics Available for: macOS Sequoia Impact: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86950: Meta Product Security macOS Sequoia 15.8.1 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmq62u0ACgkQ4Ifiq8DH 7PX9EA//e/Qc6ZrztZtDMNq4xfGbKbIgzNz09jLjIcp0nLU//UWcW3JejP71nu8W IFV9hR77huzaia1Er7nIyt0UGEWLZqHECVhFJNhD4cN+A5tiYSnUk7XWnFWAZz+S sWOrddC3A5rb6IsoiHCuZ1fZOI9nNPda3xw/KGZ56FWSy+hsoFC0c1yMSj3gZ7jC tT1y1qF5UU4B0VbbZKG9w3z3J2smYmgtHzoOp/lRUrbQQ90tuPKEaVJWiqkLBR2P OUfKoSRXLPQ/GjRpo1AwEEZeS0r4MVkCm8uedhF3mdTkpH2sgYWQtM74FEKe6N1a /48B8Tn/CpgdhIWNP6VEpJC4p0RG2X2Gt2mvuedDwqR3EId3HGiSUTIaPI++xRWL f0rBFVJeLHZLJQphzEwFHXk6xK7XE8g+xQuImTchwY2JQjWpFY85yTMD/vZt16k7 MYyEsoGC9Cg5nIvlFfrPRSJM0aShEPmX6s1T1zx1UQ5AASbSiW6BtX7CIeXVPwCW Gla6vrseGwk6UoxOjqtEHiXaSkpSMb70du5DJBftkWHTPIIEF3XNOggcZfLPqxKw aRYdNDHPFmOALhviZpcuNMyN1ALIOfw07sD2XawXD+JE8BPYqzvDJXU2WOYSjc1C 2iNeM38fbJbpvHpE+KcxaJ2lC2BqKRIDyrZcF6ZGeVO7v3sLuIE= =uNAH -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Apple Macos Sequoia Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0403 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Macos Sequoia",
          "vendor": "Apple",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1\n\nmacOS Sequoia 15.8.1 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149229.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nCoreGraphics\nAvailable for: macOS Sequoia\nImpact: Processing a maliciously crafted file may lead to arbitrary code\nexecution. Apple is aware of a report that this issue may have been\nexploited in an extremely sophisticated attack against specific targeted\nindividuals on versions of iOS before iOS 27.\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86950: Meta Product Security\n\nmacOS Sequoia 15.8.1 may be obtained from the Mac App Store or\nApple\u0027s Software Downloads web site:\nhttps://support.apple.com/downloads/\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmq62u0ACgkQ4Ifiq8DH\n7PX9EA//e/Qc6ZrztZtDMNq4xfGbKbIgzNz09jLjIcp0nLU//UWcW3JejP71nu8W\nIFV9hR77huzaia1Er7nIyt0UGEWLZqHECVhFJNhD4cN+A5tiYSnUk7XWnFWAZz+S\nsWOrddC3A5rb6IsoiHCuZ1fZOI9nNPda3xw/KGZ56FWSy+hsoFC0c1yMSj3gZ7jC\ntT1y1qF5UU4B0VbbZKG9w3z3J2smYmgtHzoOp/lRUrbQQ90tuPKEaVJWiqkLBR2P\nOUfKoSRXLPQ/GjRpo1AwEEZeS0r4MVkCm8uedhF3mdTkpH2sgYWQtM74FEKe6N1a\n/48B8Tn/CpgdhIWNP6VEpJC4p0RG2X2Gt2mvuedDwqR3EId3HGiSUTIaPI++xRWL\nf0rBFVJeLHZLJQphzEwFHXk6xK7XE8g+xQuImTchwY2JQjWpFY85yTMD/vZt16k7\nMYyEsoGC9Cg5nIvlFfrPRSJM0aShEPmX6s1T1zx1UQ5AASbSiW6BtX7CIeXVPwCW\nGla6vrseGwk6UoxOjqtEHiXaSkpSMb70du5DJBftkWHTPIIEF3XNOggcZfLPqxKw\naRYdNDHPFmOALhviZpcuNMyN1ALIOfw07sD2XawXD+JE8BPYqzvDJXU2WOYSjc1C\n2iNeM38fbJbpvHpE+KcxaJ2lC2BqKRIDyrZcF6ZGeVO7v3sLuIE=\n=uNAH\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/91"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/91"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149229"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/91"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-28-2026-3 macOS Sequoia 15.8.1",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-86950",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0403",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/91",
            "automated": true,
            "contentSha256": "55d9231818856582c9b448f9bafa33fd597acf45876dc213e0a57fe403e2b2ff",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/91",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-28T22:13:55Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0403"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0403"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.