# Sequoia 15.0 Sequoia 15.0, released September 16, 2024, fixes 98 CVEs in Sequoia. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/macos/sequoia-15.0 - Platform: macOS - Released: Sep 16, 2024 - Priority: Urgent (Closes CVE-2023-5841, rated Critical) - CVEs: 98, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.apple.com/en-us/121238 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Sequoia](https://patchblox.com/security/data/product/macos/sequoia.md) | | 15.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2023-5841](https://patchblox.com/security/data/cve/CVE-2023-5841.md) | Urgent | Model I/O: Processing a maliciously crafted image may lead to a denial-of-service | 9.1 | 0.0125 | | | [CVE-2024-44146](https://patchblox.com/security/data/cve/CVE-2024-44146.md) | Urgent | copyfile: An app may be able to break out of its sandbox | 10.0 | 0.0075 | | | [CVE-2024-44148](https://patchblox.com/security/data/cve/CVE-2024-44148.md) | Urgent | Disk Images: An app may be able to break out of its sandbox | 10.0 | 0.0067 | | | [CVE-2024-39894](https://patchblox.com/security/data/cve/CVE-2024-39894.md) | High | OpenSSH: Multiple issues in OpenSSH | 7.5 | 0.0163 | | | [CVE-2024-40856](https://patchblox.com/security/data/cve/CVE-2024-40856.md) | High | Wi-Fi: An attacker may be able to force a device to disconnect from a secure network | 7.5 | 0.0089 | | | [CVE-2024-44165](https://patchblox.com/security/data/cve/CVE-2024-44165.md) | High | Kernel: Network traffic may leak outside a VPN tunnel | 7.5 | 0.0078 | | | [CVE-2024-40848](https://patchblox.com/security/data/cve/CVE-2024-40848.md) | High | AppleMobileFileIntegrity: An attacker may be able to read sensitive information | 7.5 | 0.0071 | | | [CVE-2024-44175](https://patchblox.com/security/data/cve/CVE-2024-44175.md) | High | Kernel: An app may be able to access sensitive user data | 7.5 | 0.0064 | | | [CVE-2023-4504](https://patchblox.com/security/data/cve/CVE-2023-4504.md) | High | CUPS: Processing a maliciously crafted file may lead to unexpected app termination | 7.0 | 0.0064 | | | [CVE-2024-54467](https://patchblox.com/security/data/cve/CVE-2024-54467.md) | High | WebKit: A malicious website may exfiltrate data cross-origin | 8.8 | 0.0063 | | | [CVE-2024-44167](https://patchblox.com/security/data/cve/CVE-2024-44167.md) | High | Notes: An app may be able to overwrite arbitrary files | 8.1 | 0.0063 | | | [CVE-2024-44152](https://patchblox.com/security/data/cve/CVE-2024-44152.md) | High | System Settings: An app may be able to access user-sensitive data | 7.5 | 0.0058 | | | [CVE-2024-44149](https://patchblox.com/security/data/cve/CVE-2024-44149.md) | High | Quick Look: An app may be able to access protected user data | 7.5 | 0.0055 | | | [CVE-2024-27869](https://patchblox.com/security/data/cve/CVE-2024-27869.md) | High | Control Center: An app may be able to record the screen without an indicator | 7.5 | 0.0053 | | | [CVE-2024-44189](https://patchblox.com/security/data/cve/CVE-2024-44189.md) | High | WindowServer: A logic issue existed where a process may be able to capture screen contents without user consent | 7.5 | 0.0052 | | | [CVE-2024-27795](https://patchblox.com/security/data/cve/CVE-2024-27795.md) | High | AppSandbox: A camera extension may be able to access the internet | 7.5 | 0.0050 | | | [CVE-2024-27876](https://patchblox.com/security/data/cve/CVE-2024-27876.md) | High | Compression: Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files | 8.1 | 0.0049 | | | [CVE-2024-40770](https://patchblox.com/security/data/cve/CVE-2024-40770.md) | High | Wi-Fi: A non-privileged user may be able to modify restricted network settings | 7.5 | 0.0049 | | | [CVE-2024-44160](https://patchblox.com/security/data/cve/CVE-2024-44160.md) | High | Intel Graphics Driver: Processing a maliciously crafted texture may lead to unexpected app termination | 7.8 | 0.0048 | | | [CVE-2024-44227](https://patchblox.com/security/data/cve/CVE-2024-44227.md) | High | Wi-Fi: An app may be able to cause unexpected system termination or corrupt kernel memory | 7.5 | 0.0045 | | | [CVE-2024-44192](https://patchblox.com/security/data/cve/CVE-2024-44192.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0045 | | | [CVE-2024-44208](https://patchblox.com/security/data/cve/CVE-2024-44208.md) | High | WindowServer: An app may be able to bypass certain Privacy preferences | 7.5 | 0.0040 | | | [CVE-2024-40841](https://patchblox.com/security/data/cve/CVE-2024-40841.md) | High | AppleVA: Processing a maliciously crafted video file may lead to unexpected app termination | 7.8 | 0.0032 | | | [CVE-2024-44122](https://patchblox.com/security/data/cve/CVE-2024-44122.md) | High | LaunchServices: An application may be able to break out of its sandbox | 8.8 | 0.0026 | | | [CVE-2024-44126](https://patchblox.com/security/data/cve/CVE-2024-44126.md) | High | ARKit: Processing a maliciously crafted file may lead to heap corruption | 7.8 | 0.0026 | | | [CVE-2024-44132](https://patchblox.com/security/data/cve/CVE-2024-44132.md) | High | ArchiveService: An app may be able to break out of its sandbox | 8.4 | 0.0024 | | | [CVE-2024-44164](https://patchblox.com/security/data/cve/CVE-2024-44164.md) | High | AppleMobileFileIntegrity: An app may be able to bypass Privacy preferences | 7.1 | 0.0023 | | | [CVE-2024-40861](https://patchblox.com/security/data/cve/CVE-2024-40861.md) | High | Installer: An app may be able to gain root privileges | 7.8 | 0.0021 | | | [CVE-2024-44176](https://patchblox.com/security/data/cve/CVE-2024-44176.md) | Routine | ImageIO: Processing an image may lead to a denial-of-service | 5.5 | 0.0794 | | | [CVE-2024-44133](https://patchblox.com/security/data/cve/CVE-2024-44133.md) | Routine | TCC: On MDM managed devices, an app may be able to bypass certain Privacy preferences | 5.5 | 0.0774 | | | [CVE-2024-40866](https://patchblox.com/security/data/cve/CVE-2024-40866.md) | Routine | WebKit: Visiting a malicious website may lead to address bar spoofing | 6.5 | 0.0093 | | | [CVE-2024-44131](https://patchblox.com/security/data/cve/CVE-2024-44131.md) | Routine | FileProvider: An app may be able to access sensitive user data | 5.5 | 0.0066 | | | [CVE-2024-44187](https://patchblox.com/security/data/cve/CVE-2024-44187.md) | Routine | WebKit: A malicious website may exfiltrate data cross-origin | 6.5 | 0.0065 | | | [CVE-2024-44155](https://patchblox.com/security/data/cve/CVE-2024-44155.md) | Routine | Safari: Maliciously crafted web content may violate iframe sandboxing policy | 6.5 | 0.0056 | | | [CVE-2024-40857](https://patchblox.com/security/data/cve/CVE-2024-40857.md) | Routine | WebKit: Processing maliciously crafted web content may lead to universal cross site scripting | 6.1 | 0.0055 | | | [CVE-2024-44151](https://patchblox.com/security/data/cve/CVE-2024-44151.md) | Routine | bless: An app may be able to modify protected parts of the file system | 6.5 | 0.0049 | | | [CVE-2024-40797](https://patchblox.com/security/data/cve/CVE-2024-40797.md) | Routine | Safari: Visiting a malicious website may lead to user interface spoofing | 6.1 | 0.0049 | | | [CVE-2024-40845](https://patchblox.com/security/data/cve/CVE-2024-40845.md) | Routine | AppleGraphicsControl: Processing a maliciously crafted video file may lead to unexpected app termination | 5.5 | 0.0037 | | | [CVE-2024-41957](https://patchblox.com/security/data/cve/CVE-2024-41957.md) | Routine | Vim: Processing a maliciously crafted file may lead to unexpected app termination | 5.3 | 0.0037 | | | [CVE-2024-44203](https://patchblox.com/security/data/cve/CVE-2024-44203.md) | Routine | Sandbox: An app may be able to access a user's Photos Library | 5.5 | 0.0036 | | | [CVE-2024-44137](https://patchblox.com/security/data/cve/CVE-2024-44137.md) | Routine | Screen Capture: An attacker with physical access may be able to share items from the lock screen | 4.6 | 0.0032 | | | [CVE-2024-44144](https://patchblox.com/security/data/cve/CVE-2024-44144.md) | Routine | SceneKit: Processing a maliciously crafted file may lead to unexpected app termination | 5.5 | 0.0030 | | | [CVE-2024-44179](https://patchblox.com/security/data/cve/CVE-2024-44179.md) | Routine | Siri: An attacker with physical access to a device may be able to read contact numbers from the lock screen | 2.4 | 0.0029 | | | [CVE-2024-44154](https://patchblox.com/security/data/cve/CVE-2024-44154.md) | Routine | AppleGraphicsControl: Processing a maliciously crafted file may lead to unexpected app termination | 5.5 | 0.0028 | | | [CVE-2024-40850](https://patchblox.com/security/data/cve/CVE-2024-40850.md) | Routine | Game Center: An app may be able to access user-sensitive data | 5.5 | 0.0027 | | | [CVE-2024-27880](https://patchblox.com/security/data/cve/CVE-2024-27880.md) | Routine | ImageIO: Processing a maliciously crafted file may lead to unexpected app termination | 5.5 | 0.0027 | | | [CVE-2024-44161](https://patchblox.com/security/data/cve/CVE-2024-44161.md) | Routine | Intel Graphics Driver: Processing a maliciously crafted texture may lead to unexpected app termination | 5.5 | 0.0026 | | | [CVE-2024-44183](https://patchblox.com/security/data/cve/CVE-2024-44183.md) | Routine | mDNSResponder: An app may be able to cause a denial-of-service | 5.5 | 0.0026 | | | [CVE-2024-44178](https://patchblox.com/security/data/cve/CVE-2024-44178.md) | Routine | PackageKit: An app may be able to modify protected parts of the file system | 5.5 | 0.0025 | | | [CVE-2024-44191](https://patchblox.com/security/data/cve/CVE-2024-44191.md) | Routine | Kernel: An app may gain unauthorized access to Bluetooth | 5.5 | 0.0025 | | | [CVE-2024-44153](https://patchblox.com/security/data/cve/CVE-2024-44153.md) | Routine | Accounts: An app may be able to access user-sensitive data | 5.5 | 0.0025 | | | [CVE-2024-44168](https://patchblox.com/security/data/cve/CVE-2024-44168.md) | Routine | AppleMobileFileIntegrity: An app may be able to modify protected parts of the file system | 5.5 | 0.0025 | | | [CVE-2024-44190](https://patchblox.com/security/data/cve/CVE-2024-44190.md) | Routine | System Settings: An app may be able to read arbitrary files | 5.5 | 0.0025 | | | [CVE-2024-54473](https://patchblox.com/security/data/cve/CVE-2024-54473.md) | Routine | Maps: An app may be able to access user-sensitive data | 5.5 | 0.0025 | | | [CVE-2024-54463](https://patchblox.com/security/data/cve/CVE-2024-54463.md) | Routine | Image Capture: An app may be able to access removable volumes without user consent | 5.5 | 0.0024 | | | [CVE-2024-40791](https://patchblox.com/security/data/cve/CVE-2024-40791.md) | Routine | Mail Accounts: An app may be able to access information about a user's contacts | 3.3 | 0.0024 | | | [CVE-2024-44158](https://patchblox.com/security/data/cve/CVE-2024-44158.md) | Routine | Shortcuts: A shortcut may output sensitive user data without consent | 5.5 | 0.0024 | | | [CVE-2024-40860](https://patchblox.com/security/data/cve/CVE-2024-40860.md) | Routine | sudo: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 | | | [CVE-2024-54560](https://patchblox.com/security/data/cve/CVE-2024-54560.md) | Routine | LaunchServices: A malicious app may be able to modify other apps without having App Management permission | 5.5 | 0.0023 | | | [CVE-2024-27860](https://patchblox.com/security/data/cve/CVE-2024-27860.md) | Routine | AppleVA: An application may be able to read restricted memory | 5.5 | 0.0023 | | | [CVE-2024-44125](https://patchblox.com/security/data/cve/CVE-2024-44125.md) | Routine | Sandbox: A malicious application may be able to leak sensitive user information | 5.5 | 0.0023 | | | [CVE-2024-44163](https://patchblox.com/security/data/cve/CVE-2024-44163.md) | Routine | Sandbox: A malicious application may be able to access private information | 5.5 | 0.0023 | | | [CVE-2024-44130](https://patchblox.com/security/data/cve/CVE-2024-44130.md) | Routine | APNs: An app with root privileges may be able to access private information | 4.4 | 0.0023 | | | [CVE-2024-44128](https://patchblox.com/security/data/cve/CVE-2024-44128.md) | Routine | Automator: An Automator Quick Action workflow may be able to bypass Gatekeeper | 5.5 | 0.0023 | | | [CVE-2024-54469](https://patchblox.com/security/data/cve/CVE-2024-54469.md) | Routine | FileProvider: A local user may be able to leak sensitive user information | 5.5 | 0.0023 | | | [CVE-2024-40842](https://patchblox.com/security/data/cve/CVE-2024-40842.md) | Routine | XProtect: An app may be able to access user-sensitive data | 5.5 | 0.0023 | | | [CVE-2024-40844](https://patchblox.com/security/data/cve/CVE-2024-40844.md) | Routine | Shortcuts: An app may be able to observe data displayed to the user by Shortcuts | 5.5 | 0.0023 | | | [CVE-2024-40847](https://patchblox.com/security/data/cve/CVE-2024-40847.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0023 | | | [CVE-2024-40826](https://patchblox.com/security/data/cve/CVE-2024-40826.md) | Routine | Printing: An unencrypted document may be written to a temporary file when using print preview | 6.1 | 0.0023 | | | [CVE-2024-27875](https://patchblox.com/security/data/cve/CVE-2024-27875.md) | Routine | Control Center: Privacy Indicators for microphone or camera access may be attributed incorrectly | 5.5 | 0.0023 | | | [CVE-2024-40801](https://patchblox.com/security/data/cve/CVE-2024-40801.md) | Routine | Security Initialization: An app may be able to access protected user data | 5.5 | 0.0023 | | | [CVE-2024-44129](https://patchblox.com/security/data/cve/CVE-2024-44129.md) | Routine | Accounts: An app may be able to leak sensitive user information | 5.5 | 0.0023 | | | [CVE-2024-40837](https://patchblox.com/security/data/cve/CVE-2024-40837.md) | Routine | AppleMobileFileIntegrity: An app may be able to access protected user data | 5.5 | 0.0023 | | | [CVE-2024-40838](https://patchblox.com/security/data/cve/CVE-2024-40838.md) | Routine | Notification Center: A malicious app may be able to access notifications from the user's device | 3.3 | 0.0023 | | | [CVE-2024-40855](https://patchblox.com/security/data/cve/CVE-2024-40855.md) | Routine | DiskArbitration: A sandboxed app may be able to access sensitive user data | 5.5 | 0.0023 | | | [CVE-2024-40825](https://patchblox.com/security/data/cve/CVE-2024-40825.md) | Routine | APFS: A malicious app with root privileges may be able to modify the contents of system files | 6.0 | 0.0022 | | | [CVE-2024-44170](https://patchblox.com/security/data/cve/CVE-2024-44170.md) | Routine | Siri: An app may be able to access user-sensitive data | 5.5 | 0.0022 | | | [CVE-2024-44135](https://patchblox.com/security/data/cve/CVE-2024-44135.md) | Routine | AppSandbox: An app may be able to access protected files within an App Sandbox container | 5.5 | 0.0022 | | | [CVE-2024-44177](https://patchblox.com/security/data/cve/CVE-2024-44177.md) | Routine | Dock: An app may be able to access user-sensitive data | 5.5 | 0.0022 | | | [CVE-2024-44181](https://patchblox.com/security/data/cve/CVE-2024-44181.md) | Routine | Maps: An app may be able to read sensitive location information | 5.5 | 0.0022 | | | [CVE-2024-44182](https://patchblox.com/security/data/cve/CVE-2024-44182.md) | Routine | App Intents: An app may be able to access sensitive data logged when a shortcut fails to launch another app | 5.5 | 0.0022 | | | [CVE-2024-44184](https://patchblox.com/security/data/cve/CVE-2024-44184.md) | Routine | Transparency: An app may be able to access user-sensitive data | 5.5 | 0.0022 | | | [CVE-2024-44186](https://patchblox.com/security/data/cve/CVE-2024-44186.md) | Routine | NSColor: An app may be able to access protected user data | 5.5 | 0.0021 | | | [CVE-2024-54558](https://patchblox.com/security/data/cve/CVE-2024-54558.md) | Routine | TCC: An app may be able to trick a user into granting access to photos from the user's photo library | 2.8 | 0.0021 | | | [CVE-2024-44172](https://patchblox.com/security/data/cve/CVE-2024-44172.md) | Routine | Contacts: An app may be able to access contacts | 3.3 | 0.0021 | | | [CVE-2024-44134](https://patchblox.com/security/data/cve/CVE-2024-44134.md) | Routine | Wi-Fi: An app may be able to read sensitive location information | 5.5 | 0.0021 | | | [CVE-2024-40831](https://patchblox.com/security/data/cve/CVE-2024-40831.md) | Routine | Image Capture: An app may be able to access a user's Photos Library | 5.5 | 0.0021 | | | [CVE-2024-40843](https://patchblox.com/security/data/cve/CVE-2024-40843.md) | Routine | XProtect: An app may be able to modify protected parts of the file system | 5.5 | 0.0020 | | | [CVE-2024-23237](https://patchblox.com/security/data/cve/CVE-2024-23237.md) | Routine | Wi-Fi: An app may be able to cause a denial-of-service | 5.5 | 0.0020 | | | [CVE-2024-44145](https://patchblox.com/security/data/cve/CVE-2024-44145.md) | Routine | Sidecar: An attacker with physical access to a macOS device with Sidecar enabled may be able to bypass the Lock Screen | 5.7 | 0.0020 | | | [CVE-2024-44174](https://patchblox.com/security/data/cve/CVE-2024-44174.md) | Routine | Screen Capture: An attacker may be able to view restricted content from the lock screen | 5.5 | 0.0020 | | | [CVE-2024-44188](https://patchblox.com/security/data/cve/CVE-2024-44188.md) | Routine | Accounts: An app may be able to access protected user data | 5.5 | 0.0019 | | | [CVE-2024-44123](https://patchblox.com/security/data/cve/CVE-2024-44123.md) | Routine | Security: A malicious app with root privileges may be able to access keyboard input and location information without user consent | 2.3 | 0.0019 | | | [CVE-2024-27858](https://patchblox.com/security/data/cve/CVE-2024-27858.md) | Routine | Music: An app may be able to access protected user data | 5.5 | 0.0019 | | | [CVE-2024-40859](https://patchblox.com/security/data/cve/CVE-2024-40859.md) | Routine | TV App: An app may be able to access user-sensitive data | 5.5 | 0.0019 | | | [CVE-2024-44198](https://patchblox.com/security/data/cve/CVE-2024-44198.md) | Routine | libxml2: Processing maliciously crafted web content may lead to an unexpected process crash | 5.5 | 0.0019 | | | [CVE-2024-27849](https://patchblox.com/security/data/cve/CVE-2024-27849.md) | Routine | Core Data: An app may be able to read sensitive location information | 3.3 | 0.0018 | | | [CVE-2024-40792](https://patchblox.com/security/data/cve/CVE-2024-40792.md) | Routine | Airport: A malicious app may be able to change network settings | 3.3 | 0.0015 | | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.