CVE Vulnerability Catalog

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. A buffer overflow may result in memory corruption and unexpected app termination.

An out-of-bounds read issue in macOS was addressed with improved input validation. The issue affects macOS Golden Gate 27.2. A remote attacker may cause an unexpected process termination.

A permissions issue in macOS was addressed with additional restrictions. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A malicious app may be able to gain root privileges.

A logic issue in macOS was addressed with improved validation. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A maliciously crafted disk image may bypass Gatekeeper checks.

An issue in Apple systems was addressed with improved checks. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

A use-after-free issue was addressed with improved memory management. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. An app may cause unexpected system termination or corrupt kernel memory.

A logic issue in macOS was addressed with improved checks. The issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A local attacker may be able to elevate their privileges.

An issue in macOS was addressed with improved validation of file attributes. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A malicious application may bypass Gatekeeper checks.

An integer overflow was addressed with improved input validation. The vulnerability affects iOS, iPadOS, and macOS. Processing a maliciously crafted image may lead to arbitrary code execution.

An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Processing a maliciously crafted image may result in memory corruption.

An authorization issue in macOS was addressed with improved state management. The issue affects macOS Golden Gate 27 and macOS Tahoe 26.7.2. An app may be able to access sensitive user data.

Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.

In Seroval from 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. The issue was fixed in version 1.6.8.

In Seroval from 1.6.0 until 1.6.11, JavaScript-output APIs derive a typed array's constructor name from a property that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and serializes it, the attacker-controlled name is written as executable JavaScript.

In Seroval prior to 1.0.0 and from 1.5.5 until 1.6.10, JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. When an application builds a RegExp from untrusted input and embeds the result in a script element, the crafted source can terminate the element and execute script.

Seroval prior to 1.6.8 does not validate a sequence node's done index in fromJSON and fromCrossJSON. A crafted done index can create an iterator that never finishes when consumed to completion, allowing an unauthenticated request to block the event loop, exhaust memory, or make the service unavailable.

In Seroval prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted input and an application plugin returning a callable value or an object exposing an 'on' method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value.

In Autobahn Python from 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete frame is inflated. An unauthenticated WebSocket client can send a small, highly compressed frame that allocates hundreds of MiB before rejection.

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

Tornado, a Python web framework and asynchronous networking library, prior to 6.6 accepts obsolete HTTP line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a header block with many obsolete line-folding continuations before application code runs, blocking other connections served by the process. The cost grows with max_header_size, and only availability is affected.