For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible.

Released July 27, 2026 for macOS Tahoe 26.6, this update addresses multiple vulnerabilities. An app may access sensitive user data (CVE-2026-43819, Omar Cerrito); gain root privileges via parsing issues (CVE-2026-43749, Adam Franke, Ashish Kunwar, Trung Nguyen of Cy Stack); fingerprint users (CVE-2026-64733, Rosyna Keller); cause system termination or corrupt kernel memory via buffer overflow (CVE-2026-64767, Dave G.); and cause denial-of-service (CVE-2026-23918, Юлия Мерцалова). Additional fixes address sandbox escapes, out-of-bounds writes, use-after-free, race conditions, authorization bypasses, and permissions issues across numerous components. Researchers including Franco Belman, Peter Malone, and others contributed to identifying these issues.