macOS Tahoe 26 Security Update

What macOS Tahoe 26 Fixes

macOS Tahoe 26, released September 15, 2025, fixes 96 vulnerabilities in 64 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes macOS Tahoe 26 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for macOS Tahoe is macOS Tahoe 26.7.2, from October 26, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get macOS Tahoe 26

Apple lists macOS Tahoe 26 for: Mac Studio (2022 and later), iMac (2020 and later), Mac Pro (2019 and later), Mac mini (2020 and later), MacBook Air with Apple silicon (2020 and later), MacBook Pro (16-inch, 2019), MacBook Pro (13-inch, 2020, Four Thunderbolt 3 ports), and MacBook Pro with Apple silicon (2020 and later).

The macOS Tahoe 26 release page has its build numbers and release history.

How to Install macOS Tahoe 26

On the Mac, open System Settings → General → Software Update. Macs that cannot run the newest macOS are offered the update for their own version there.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past macOS Tahoe 26 there is nothing to do.

Every Fix in macOS Tahoe 26

All 96 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• AppleMobileFileIntegrity

  An app may be able to break out of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43340

• AppleMobileFileIntegrity

  An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges

  The issue was addressed by adding additional logic.

  CVE-2025-43320

• ATS

  An app may be able to break out of its sandbox

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43330

• Audio

  A malicious app may be able to read kernel memory

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43361

• Crash Reporter

  An app may be able to gain root privileges

  A race condition was addressed with additional validation.

  CVE-2025-46284

• DiskArbitration

  A malicious app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43316

• PackageKit

  An app may be able to gain root privileges

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43298

• PackageKit

  An attacker with root privileges may be able to delete protected system files

  This issue was addressed through improved state management.

  CVE-2025-46310

• RemoteViewServices

  An app may be able to break out of its sandbox

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43204

• Sandbox

  An app may be able to break out of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43329

• Sandbox

  An app with root privileges may be able to access private information

  This issue was addressed with additional entitlement checks.

  CVE-2025-43318

• Security Initialization

  An app may be able to break out of its sandbox

  A file quarantine bypass was addressed with additional checks.

  CVE-2025-43332

• SharedFileList

  An app may be able to break out of its sandbox

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43286

• Shortcuts

  A shortcut may be able to bypass sandbox restrictions

  A permissions issue was addressed with additional sandbox restrictions.

  CVE-2025-43358

• Spotlight

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43333

• Storage

  An app may be able to gain root privileges

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43341

• StorageKit

  An app may be able to gain root privileges

  A race condition was addressed with improved state handling.

  CVE-2025-43304

• StorageKit

  A malicious app may be able to gain root privileges

  A logic issue was addressed with improved checks.

  CVE-2025-43306

• AirPort

  An app may be able to read sensitive location information

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43208

• AppKit

  An app may be able to access protected user data

  The issue was resolved by blocking unsigned services from launching on Intel Macs.

  CVE-2025-43321

• Apple Online Store Kit

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31268

• AppleMobileFileIntegrity

  An app may be able to access protected user data

  A downgrade issue was addressed with additional code-signing restrictions.

  CVE-2025-43331

• AppleMobileFileIntegrity

  An app may be able to access sensitive user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43317

• AppleMobileFileIntegrity

  An app may be able to access sensitive user data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-43337

• AppSandbox

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43285

• Archive Utility

  An app may be able to bypass Privacy preferences

  This issue was addressed with improved validation of symlinks.

  CVE-2025-43288

• AWD

  An app may be able to access sensitive user data

  A permissions issue was addressed by removing the vulnerable code.

  CVE-2025-43451

• Bluetooth

  An app may be able to access sensitive user data

  This issue was addressed with improved checks to prevent unauthorized actions.

  CVE-2025-43307

• Bluetooth

  An app may be able to access sensitive user data

  A logging issue was addressed with improved data redaction.

  CVE-2025-43354 CVE-2025-43303

• Compression

  An app may be able to access sensitive user data

  An authorization issue was addressed with improved state management.

  CVE-2025-43403

• CoreMedia

  An app may be able to access sensitive user data

  A race condition was addressed with improved state handling.

  CVE-2025-43292

• CoreServices

  A malicious app may be able to access private information

  A logic issue was addressed with improved checks.

  CVE-2025-43305

• CoreServices

  A malicious app may be able to access sensitive user data

  A logic issue was addressed with improved validation.

  CVE-2025-43289

• FaceTime

  Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen

  This issue was addressed through improved state management.

  CVE-2025-31271

• Foundation

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31270

• GPU Drivers

  An app may be able to access sensitive user data

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43326

• Icons

  An app may be able to access sensitive user data

  An access issue was addressed with additional sandbox restrictions.

  CVE-2025-43325

• IOKit

  An app may be able to access sensitive user data

  An authorization issue was addressed with improved state management.

  CVE-2025-31255

• Kernel

  An app may be able to access sensitive user data

  A correctness issue was addressed with improved checks.

  CVE-2025-43345

• MallocStackLogging

  An app may be able to access sensitive user data

  An issue existed in the handling of environment variables. This issue was addressed with improved validation.

  CVE-2025-43294

• MediaLibrary

  An app may be able to access protected user data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43319

• MigrationKit

  An app may be able to access user-sensitive data

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43315

• Music

  An app may be able to access user-sensitive data

  This issue was addressed with improved entitlements.

  CVE-2025-43207

• Notification Center

  An app may be able to access user-sensitive data

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-43279

• Printing

  An app may be able to access protected user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-31269

• Sandbox

  An app may be able to access sensitive user data

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43328

• Sandbox

  An app may be able to access sensitive user data

  A logic issue was addressed with improved restrictions.

  CVE-2025-46307

• SharedFileList

  An app may be able to access sensitive user data

  The issue was addressed with improved input validation.

  CVE-2025-43293

• SharedFileList

  An app may be able to access protected user data

  This issue was addressed with improved handling of symlinks.

  CVE-2025-43369

• Siri

  An app may be able to access protected user data

  A privacy issue was addressed by moving sensitive data.

  CVE-2025-43367

• Spell Check

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43190

• Spotlight

  An app may be able to access sensitive user data

  A logic issue was addressed with improved checks.

  CVE-2025-24197

• StorageKit

  An app may be able to access sensitive user data

  A parsing issue in the handling of directory paths was addressed with improved path validation.

  CVE-2025-43314

• System Settings

  An app may bypass Gatekeeper checks

  A logic issue was addressed with improved validation.

  CVE-2025-43296

• Touch Bar

  An app may be able to access protected user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43311

• Touch Bar Controls

  An app may be able to access sensitive user data

  This issue was addressed with additional entitlement checks.

  CVE-2025-43308

• WebKit

  A remote attacker may be able to view leaked DNS queries with Private Relay turned on

  A logic issue was addressed with improved state management.

  CVE-2025-43376

• WindowServer

  An app may be able to trick a user into copying sensitive data to the pasteboard

  A configuration issue was addressed with additional restrictions.

  CVE-2025-43310

• Safari

  Visiting a malicious website may lead to address bar spoofing

  The issue was addressed by adding additional logic.

  CVE-2025-43327

• AMD

  An app may be able to cause unexpected system termination

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-43312

• Apple Neural Engine

  An app may be able to cause unexpected system termination

  An out-of-bounds access issue was addressed with improved bounds checking.

  CVE-2025-43344

• Audio

  Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

  An out-of-bounds access issue was addressed with improved bounds checking.

  CVE-2025-43346

• CoreAudio

  Processing a maliciously crafted video file may lead to unexpected app termination

  An out-of-bounds write issue was addressed with improved input validation.

  CVE-2025-43349

• CoreMedia

  Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

  The issue was addressed with improved input validation.

  CVE-2025-43372

• GPU Drivers

  An app may be able to cause unexpected system termination

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43283 CVE-2025-46280

• ImageIO

  Processing a maliciously crafted image may corrupt process memory

  The issue was addressed with improved memory handling.

  CVE-2025-43287

• ImageIO

  Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory

  An out-of-bounds access issue was addressed with improved bounds checking.

  CVE-2025-43338

• IOHIDFamily

  An app may be able to cause unexpected system termination

  An out-of-bounds write issue was addressed with improved bounds checking.

  CVE-2025-43302

• libc

  An app may be able to cause a denial-of-service

  A denial-of-service issue was addressed with improved validation.

  CVE-2025-43299 CVE-2025-43295

• Libinfo

  Processing a maliciously crafted string may lead to heap corruption

  The issue was addressed with improved bounds checks.

  CVE-2025-43353

• MobileStorageMounter

  An app may be able to cause a denial-of-service

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-43355

• Power Management

  An app may be able to cause a denial-of-service

  A type confusion issue was addressed with improved memory handling.

  CVE-2025-43297

• Ruby

  Processing a file may lead to a denial-of-service or potentially disclose memory contents

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2024-27280

• SQLite

  Processing a file may lead to memory corruption

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-6965

• WebKit

  Processing maliciously crafted web content may lead to an unexpected Safari crash

  The issue was addressed with improved memory handling.

  CVE-2025-43272

• WebKit

  Processing maliciously crafted web content may lead to an unexpected process crash

  The issue was addressed with improved memory handling.

  CVE-2025-43343

• WebKit

  Processing maliciously crafted web content may lead to an unexpected process crash

  A correctness issue was addressed with improved checks.

  CVE-2025-43342

• WebKit

  Processing maliciously crafted web content may lead to memory corruption

  The issue was addressed with improved memory handling.

  CVE-2025-43419

• WebKit Process Model

  Processing maliciously crafted web content may lead to an unexpected Safari crash

  A use-after-free issue was addressed with improved memory management.

  CVE-2025-43368

• Call History

  An app may be able to fingerprint the user

  This issue was addressed with improved redaction of sensitive information.

  CVE-2025-43357

• CloudKit

  An app may be able to fingerprint the user

  This issue was addressed with additional entitlement checks.

  CVE-2025-43323

• CoreServices

  An app may be able to override MDM-enforced settings from profiles

  The issue was addressed by adding additional logic.

  CVE-2025-24088

• CoreServices

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43290

• IOMobileFrameBuffer

  An app may be able to disclose coprocessor memory

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2025-43366

• Kernel

  A UDP server socket bound to a local interface may become bound to all interfaces

  A logic issue was addressed with improved state management.

  CVE-2025-43359

• Notification Center

  An app may be able to access contact info related to notifications in Notification Center

  A privacy issue was addressed with improved private data redaction for log entries.

  CVE-2025-43301

• Perl

  Multiple issues in Perl

  This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org .

  CVE-2025-40909

• QuickLook

  Processing a maliciously crafted Keynote file may disclose memory contents

  The issue was addressed with improved bounds checks.

  CVE-2025-46306

• Screenshots

  An app may be able to capture a screenshot of an app entering or exiting full screen mode

  A privacy issue was addressed with improved checks.

  CVE-2025-31259

• SharedFileList

  An app may be able to modify protected parts of the file system

  A permissions issue was addressed by removing the vulnerable code.

  CVE-2025-43291

• Spotlight

  Processing a maliciously crafted Keynote file may disclose memory contents

  The issue was addressed with improved bounds checks.

  CVE-2025-46306

• System

  An input validation issue was addressed

  This issue was addressed by removing the vulnerable code.

  CVE-2025-43347

• Trusted Device

  USB Restricted Mode may not be applied to accessories connected during boot

  A permissions issue was addressed with additional restrictions.

  CVE-2025-43262

• WebKit

  A website may be able to access sensor information without user consent

  The issue was addressed with improved handling of caches.

  CVE-2025-43356

macOS Tahoe Security Release History

macOS Tahoe 26 in context: the security releases Apple has published for macOS Tahoe, newest first, with the number of fixes each carried.

The Same Fixes Elsewhere

Apple ships most fixes to every platform that shares the code, and to older versions still under support. These releases close at least one of the same CVEs:

Frequently Asked Questions