Apple released new security updates for macOS on October 26, 2026. The macOS Tahoe 26.7.2 release fixed 213 vulnerabilities, and macOS Sequoia 15.8.2 fixed 197. The macOS Golden Gate 27.2 update, released the same day, fixed 263 CVE records. According to Apple’s advisories, a significant portion of these flaws can be triggered when a maliciously crafted file is opened or an application is run.
The advisories do not indicate that the flaws are being actively exploited, and neither of the two records appears on CISA’s KEV list. Still, the updates fix serious bugs in the kernel, Gatekeeper, and image-processing layers.
17 kernel flaws, one allows code execution with kernel privileges
The Tahoe 26.7.2 advisory lists 17 separate records under the kernel heading. One of them, CVE-2026-86916, allowed an application to execute arbitrary code with kernel privileges through a use-after-free bug. CVE-2026-112438 describes a logic flaw that lets an unauthorized attacker execute code as root. A large part of the list consists of memory bugs that allow applications to corrupt kernel memory or crash the system. CVE-2026-112543, which enables sandbox escapes, was also fixed under the same heading.
Two flaws in Grapher and CUPS
According to the NVD records, CVE-2026-86929 is an overflow bug in the Grapher component caused by missing bounds checking. Opening a maliciously crafted file can lead to arbitrary code execution, and NVD assigns this flaw a CVSS score of 8.8. CVE-2026-65327 is a logic flaw in the CUPS printing service; a local attacker can use it to escalate privileges, with a score of 8.4. Both were fixed in the same updates.
Images, Gatekeeper, and Wi-Fi
There are 15 separate flaws in the ImageIO component. They can cause memory corruption, process memory disclosure, or app crashes when a malformed image file is previewed or opened in an app. CVE-2026-64789 allowed a malicious app to bypass Gatekeeper checks because of a validation flaw in the quarantine mechanism. On the screen-sharing side, CVE-2026-112519 can cause a denial of service when connecting to a malicious VNC server. For CVE-2026-112622 in the Wi-Fi driver, an attacker within radio range is enough.
How to update
You can install the update by opening Software Update under General in System Settings. Tahoe users should move to 26.7.2, Sequoia users to 15.8.2, and Golden Gate users to 27.2. Keeping automatic security responses enabled means you can receive patches for future flaws without waiting for them manually.
Putting off macOS updates is a common habit, especially on corporate devices. But most of the bugs in this release only require the user to open a file. Applying the patch within a few days is the fastest way to close the attack surface.
Source: Apple Security Advisories · NVD
Share your experience
Bir sorunun, farklı bir çözümün veya eklemek istediğin bir notun var mı? Giriş yapmadan da yazabilirsin.