# Tahoe 26.0 Tahoe 26.0, released September 15, 2025, fixes 94 CVEs in Tahoe. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/macos/tahoe-26.0 - Platform: macOS - Released: Sep 15, 2025 - Priority: Urgent (Closes CVE-2024-27280, rated Critical) - CVEs: 94, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://support.apple.com/en-us/125110 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Tahoe](https://patchblox.com/security/data/product/macos/tahoe.md) | | 26.0 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2024-27280](https://patchblox.com/security/data/cve/CVE-2024-27280.md) | Urgent | Ruby: Processing a file may lead to a denial-of-service or potentially disclose memory contents | 9.8 | 0.0236 | | | [CVE-2025-31255](https://patchblox.com/security/data/cve/CVE-2025-31255.md) | Urgent | IOKit: An app may be able to access sensitive user data | 9.8 | 0.0163 | | | [CVE-2025-43359](https://patchblox.com/security/data/cve/CVE-2025-43359.md) | Urgent | Kernel: A UDP server socket bound to a local interface may become bound to all interfaces | 9.8 | 0.0096 | | | [CVE-2025-43347](https://patchblox.com/security/data/cve/CVE-2025-43347.md) | Urgent | System: An input validation issue was addressed | 9.8 | 0.0092 | | | [CVE-2025-43343](https://patchblox.com/security/data/cve/CVE-2025-43343.md) | Urgent | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 9.8 | 0.0080 | | | [CVE-2025-43342](https://patchblox.com/security/data/cve/CVE-2025-43342.md) | Urgent | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 9.8 | 0.0077 | | | [CVE-2025-6965](https://patchblox.com/security/data/cve/CVE-2025-6965.md) | High | SQLite: Processing a file may lead to memory corruption | 7.7 | 0.7345 | | | [CVE-2025-43272](https://patchblox.com/security/data/cve/CVE-2025-43272.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0108 | | | [CVE-2025-43376](https://patchblox.com/security/data/cve/CVE-2025-43376.md) | High | WebKit: A remote attacker may be able to view leaked DNS queries with Private Relay turned on | 7.5 | 0.0082 | | | [CVE-2025-43368](https://patchblox.com/security/data/cve/CVE-2025-43368.md) | High | WebKit Process Model: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0081 | | | [CVE-2025-43356](https://patchblox.com/security/data/cve/CVE-2025-43356.md) | High | WebKit: A website may be able to access sensor information without user consent | 8.8 | 0.0067 | | | [CVE-2025-24088](https://patchblox.com/security/data/cve/CVE-2025-24088.md) | High | CoreServices: An app may be able to override MDM-enforced settings from profiles | 7.5 | 0.0048 | | | [CVE-2025-43419](https://patchblox.com/security/data/cve/CVE-2025-43419.md) | High | WebKit: Processing maliciously crafted web content may lead to memory corruption | 8.8 | 0.0040 | | | [CVE-2025-31271](https://patchblox.com/security/data/cve/CVE-2025-31271.md) | High | FaceTime: Incoming FaceTime calls can appear or be accepted on a locked macOS device, even with notifications disabled on the lock screen | 7.5 | 0.0040 | | | [CVE-2025-43323](https://patchblox.com/security/data/cve/CVE-2025-43323.md) | High | CloudKit: An app may be able to fingerprint the user | 8.1 | 0.0040 | | | [CVE-2025-43204](https://patchblox.com/security/data/cve/CVE-2025-43204.md) | High | RemoteViewServices: An app may be able to break out of its sandbox | 7.8 | 0.0034 | | | [CVE-2025-43333](https://patchblox.com/security/data/cve/CVE-2025-43333.md) | High | Spotlight: An app may be able to gain root privileges | 7.8 | 0.0034 | | | [CVE-2025-43316](https://patchblox.com/security/data/cve/CVE-2025-43316.md) | High | DiskArbitration: A malicious app may be able to gain root privileges | 7.8 | 0.0032 | | | [CVE-2025-43329](https://patchblox.com/security/data/cve/CVE-2025-43329.md) | High | Sandbox: An app may be able to break out of its sandbox | 8.8 | 0.0031 | | | [CVE-2025-43358](https://patchblox.com/security/data/cve/CVE-2025-43358.md) | High | Shortcuts: A shortcut may be able to bypass sandbox restrictions | 8.8 | 0.0030 | | | [CVE-2025-43338](https://patchblox.com/security/data/cve/CVE-2025-43338.md) | High | ImageIO: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 7.1 | 0.0026 | | | [CVE-2025-43304](https://patchblox.com/security/data/cve/CVE-2025-43304.md) | High | StorageKit: An app may be able to gain root privileges | 7.0 | 0.0026 | | | [CVE-2025-31259](https://patchblox.com/security/data/cve/CVE-2025-31259.md) | High | Screenshots: An app may be able to capture a screenshot of an app entering or exiting full screen mode | 7.8 | 0.0025 | | | [CVE-2025-43298](https://patchblox.com/security/data/cve/CVE-2025-43298.md) | High | PackageKit: An app may be able to gain root privileges | 7.8 | 0.0025 | | | [CVE-2025-43330](https://patchblox.com/security/data/cve/CVE-2025-43330.md) | High | ATS: An app may be able to break out of its sandbox | 8.2 | 0.0023 | | | [CVE-2025-43287](https://patchblox.com/security/data/cve/CVE-2025-43287.md) | High | ImageIO: Processing a maliciously crafted image may corrupt process memory | 7.1 | 0.0023 | | | [CVE-2025-43361](https://patchblox.com/security/data/cve/CVE-2025-43361.md) | High | Audio: A malicious app may be able to read kernel memory | 7.8 | 0.0021 | | | [CVE-2025-43286](https://patchblox.com/security/data/cve/CVE-2025-43286.md) | High | SharedFileList: An app may be able to break out of its sandbox | 7.8 | 0.0019 | | | [CVE-2025-43340](https://patchblox.com/security/data/cve/CVE-2025-43340.md) | High | AppleMobileFileIntegrity: An app may be able to break out of its sandbox | 7.8 | 0.0019 | | | [CVE-2025-43320](https://patchblox.com/security/data/cve/CVE-2025-43320.md) | High | AppleMobileFileIntegrity: An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges | 7.8 | 0.0019 | | | [CVE-2025-43341](https://patchblox.com/security/data/cve/CVE-2025-43341.md) | High | Storage: An app may be able to gain root privileges | 7.8 | 0.0019 | | | [CVE-2025-43306](https://patchblox.com/security/data/cve/CVE-2025-43306.md) | High | StorageKit: A malicious app may be able to gain root privileges | 7.8 | 0.0014 | | | [CVE-2025-46284](https://patchblox.com/security/data/cve/CVE-2025-46284.md) | High | Crash Reporter: An app may be able to gain root privileges | 7.0 | 0.0010 | | | [CVE-2025-43349](https://patchblox.com/security/data/cve/CVE-2025-43349.md) | Routine | CoreAudio: Processing a maliciously crafted video file may lead to unexpected app termination | 2.8 | 0.0052 | | | [CVE-2025-43372](https://patchblox.com/security/data/cve/CVE-2025-43372.md) | Routine | ImageIO: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 6.5 | 0.0052 | | | [CVE-2025-40909](https://patchblox.com/security/data/cve/CVE-2025-40909.md) | Routine | Perl threads have a working directory race condition where file operations may target unintended paths | 5.9 | 0.0050 | | | [CVE-2025-43327](https://patchblox.com/security/data/cve/CVE-2025-43327.md) | Routine | Safari: Visiting a malicious website may lead to address bar spoofing | 6.5 | 0.0050 | | | [CVE-2025-43283](https://patchblox.com/security/data/cve/CVE-2025-43283.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 3.3 | 0.0040 | | | [CVE-2025-43308](https://patchblox.com/security/data/cve/CVE-2025-43308.md) | Routine | Touch Bar Controls: An app may be able to access sensitive user data | 3.3 | 0.0040 | | | [CVE-2025-43297](https://patchblox.com/security/data/cve/CVE-2025-43297.md) | Routine | Power Management: An app may be able to cause a denial-of-service | 6.2 | 0.0037 | | | [CVE-2025-43285](https://patchblox.com/security/data/cve/CVE-2025-43285.md) | Routine | AppSandbox: An app may be able to access protected user data | 5.5 | 0.0034 | | | [CVE-2025-43344](https://patchblox.com/security/data/cve/CVE-2025-43344.md) | Routine | Apple Neural Engine: An app may be able to cause unexpected system termination | 3.3 | 0.0033 | | | [CVE-2025-43190](https://patchblox.com/security/data/cve/CVE-2025-43190.md) | Routine | Spell Check: An app may be able to access sensitive user data | 5.5 | 0.0027 | | | [CVE-2025-43302](https://patchblox.com/security/data/cve/CVE-2025-43302.md) | Routine | IOHIDFamily: An app may be able to cause unexpected system termination | 5.5 | 0.0026 | | | [CVE-2025-43312](https://patchblox.com/security/data/cve/CVE-2025-43312.md) | Routine | AMD: An app may be able to cause unexpected system termination | 5.5 | 0.0026 | | | [CVE-2025-43314](https://patchblox.com/security/data/cve/CVE-2025-43314.md) | Routine | StorageKit: An app may be able to access sensitive user data | 5.5 | 0.0025 | | | [CVE-2025-43346](https://patchblox.com/security/data/cve/CVE-2025-43346.md) | Routine | Audio: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 5.5 | 0.0024 | | | [CVE-2025-43355](https://patchblox.com/security/data/cve/CVE-2025-43355.md) | Routine | MobileStorageMounter: An app may be able to cause a denial-of-service | 5.5 | 0.0024 | | | [CVE-2025-43293](https://patchblox.com/security/data/cve/CVE-2025-43293.md) | Routine | SharedFileList: An app may be able to access sensitive user data | 5.5 | 0.0023 | | | [CVE-2025-43299](https://patchblox.com/security/data/cve/CVE-2025-43299.md) | Routine | libc: An app may be able to cause a denial-of-service | 5.5 | 0.0023 | | | [CVE-2025-43311](https://patchblox.com/security/data/cve/CVE-2025-43311.md) | Routine | Touch Bar: An app may be able to access protected user data | 5.1 | 0.0023 | | | [CVE-2025-43301](https://patchblox.com/security/data/cve/CVE-2025-43301.md) | Routine | Notification Center: An app may be able to access contact info related to notifications in Notification Center | 3.3 | 0.0023 | | | [CVE-2025-43357](https://patchblox.com/security/data/cve/CVE-2025-43357.md) | Routine | Call History: An app may be able to fingerprint the user | 5.5 | 0.0023 | | | [CVE-2025-43354](https://patchblox.com/security/data/cve/CVE-2025-43354.md) | Routine | Bluetooth: An app may be able to access sensitive user data | 5.5 | 0.0023 | | | [CVE-2025-43326](https://patchblox.com/security/data/cve/CVE-2025-43326.md) | Routine | GPU Drivers: An app may be able to access sensitive user data | 5.5 | 0.0023 | | | [CVE-2025-43305](https://patchblox.com/security/data/cve/CVE-2025-43305.md) | Routine | CoreServices: A malicious app may be able to access private information | 5.5 | 0.0022 | | | [CVE-2025-43317](https://patchblox.com/security/data/cve/CVE-2025-43317.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43319](https://patchblox.com/security/data/cve/CVE-2025-43319.md) | Routine | MediaLibrary: An app may be able to access protected user data | 5.5 | 0.0022 | | | [CVE-2025-43321](https://patchblox.com/security/data/cve/CVE-2025-43321.md) | Routine | AppKit: An app may be able to access protected user data | 5.5 | 0.0022 | | | [CVE-2025-31269](https://patchblox.com/security/data/cve/CVE-2025-31269.md) | Routine | Printing: An app may be able to access protected user data | 5.5 | 0.0022 | | | [CVE-2025-43291](https://patchblox.com/security/data/cve/CVE-2025-43291.md) | Routine | SharedFileList: An app may be able to modify protected parts of the file system | 5.5 | 0.0022 | | | [CVE-2025-43367](https://patchblox.com/security/data/cve/CVE-2025-43367.md) | Routine | Siri: An app may be able to access protected user data | 5.5 | 0.0022 | | | [CVE-2025-24197](https://patchblox.com/security/data/cve/CVE-2025-24197.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-31268](https://patchblox.com/security/data/cve/CVE-2025-31268.md) | Routine | Apple Online Store Kit: An app may be able to access protected user data | 5.5 | 0.0021 | | | [CVE-2025-43315](https://patchblox.com/security/data/cve/CVE-2025-43315.md) | Routine | MigrationKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43310](https://patchblox.com/security/data/cve/CVE-2025-43310.md) | Routine | WindowServer: An app may be able to trick a user into copying sensitive data to the pasteboard | 4.4 | 0.0021 | | | [CVE-2025-43279](https://patchblox.com/security/data/cve/CVE-2025-43279.md) | Routine | Notification Center: An app may be able to access user-sensitive data | 6.2 | 0.0021 | | | [CVE-2025-43325](https://patchblox.com/security/data/cve/CVE-2025-43325.md) | Routine | Icons: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43366](https://patchblox.com/security/data/cve/CVE-2025-43366.md) | Routine | IOMobileFrameBuffer: An app may be able to disclose coprocessor memory | 5.5 | 0.0021 | | | [CVE-2025-43353](https://patchblox.com/security/data/cve/CVE-2025-43353.md) | Routine | Libinfo: Processing a maliciously crafted string may lead to heap corruption | 5.5 | 0.0021 | | | [CVE-2025-43318](https://patchblox.com/security/data/cve/CVE-2025-43318.md) | Routine | Sandbox: An app with root privileges may be able to access private information | 6.2 | 0.0020 | | | [CVE-2025-31270](https://patchblox.com/security/data/cve/CVE-2025-31270.md) | Routine | Foundation: An app may be able to access protected user data | 5.5 | 0.0020 | | | [CVE-2025-43207](https://patchblox.com/security/data/cve/CVE-2025-43207.md) | Routine | Music: An app may be able to access user-sensitive data | 5.5 | 0.0020 | | | [CVE-2025-43208](https://patchblox.com/security/data/cve/CVE-2025-43208.md) | Routine | AirPort: An app may be able to read sensitive location information | 5.5 | 0.0020 | | | [CVE-2025-43403](https://patchblox.com/security/data/cve/CVE-2025-43403.md) | Routine | Compression: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43262](https://patchblox.com/security/data/cve/CVE-2025-43262.md) | Routine | Trusted Device: USB Restricted Mode may not be applied to accessories connected during boot | 5.1 | 0.0020 | | | [CVE-2025-43332](https://patchblox.com/security/data/cve/CVE-2025-43332.md) | Routine | Security Initialization: An app may be able to break out of its sandbox | 5.2 | 0.0019 | | | [CVE-2025-43331](https://patchblox.com/security/data/cve/CVE-2025-43331.md) | Routine | AppleMobileFileIntegrity: An app may be able to access protected user data | 4.0 | 0.0019 | | | [CVE-2025-43307](https://patchblox.com/security/data/cve/CVE-2025-43307.md) | Routine | Bluetooth: An app may be able to access sensitive user data | 4.0 | 0.0019 | | | [CVE-2025-43288](https://patchblox.com/security/data/cve/CVE-2025-43288.md) | Routine | Archive Utility: An app may be able to bypass Privacy preferences | 5.5 | 0.0019 | | | [CVE-2025-43337](https://patchblox.com/security/data/cve/CVE-2025-43337.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43369](https://patchblox.com/security/data/cve/CVE-2025-43369.md) | Routine | SharedFileList: An app may be able to access protected user data | 5.5 | 0.0019 | | | [CVE-2025-46310](https://patchblox.com/security/data/cve/CVE-2025-46310.md) | Routine | PackageKit: An attacker with root privileges may be able to delete protected system files | 6.0 | 0.0019 | | | [CVE-2025-43294](https://patchblox.com/security/data/cve/CVE-2025-43294.md) | Routine | MallocStackLogging: An app may be able to access sensitive user data | 3.3 | 0.0019 | | | [CVE-2025-43292](https://patchblox.com/security/data/cve/CVE-2025-43292.md) | Routine | CoreMedia: An app may be able to access sensitive user data | 5.5 | 0.0017 | | | [CVE-2025-43328](https://patchblox.com/security/data/cve/CVE-2025-43328.md) | Routine | Sandbox: An app may be able to access sensitive user data | 3.3 | 0.0017 | | | [CVE-2025-43345](https://patchblox.com/security/data/cve/CVE-2025-43345.md) | Routine | Kernel: An app may be able to access sensitive user data | 5.5 | 0.0016 | | | [CVE-2025-46307](https://patchblox.com/security/data/cve/CVE-2025-46307.md) | Routine | Sandbox: An app may be able to access sensitive user data | 5.5 | 0.0015 | | | [CVE-2025-46306](https://patchblox.com/security/data/cve/CVE-2025-46306.md) | Routine | QuickLook: Processing a maliciously crafted Keynote file may disclose memory contents | 5.5 | 0.0015 | | | [CVE-2025-43296](https://patchblox.com/security/data/cve/CVE-2025-43296.md) | Routine | System Settings: An app may bypass Gatekeeper checks | 5.5 | 0.0014 | | | [CVE-2025-43289](https://patchblox.com/security/data/cve/CVE-2025-43289.md) | Routine | CoreServices: A malicious app may be able to access sensitive user data | 5.5 | 0.0014 | | | [CVE-2025-46280](https://patchblox.com/security/data/cve/CVE-2025-46280.md) | Routine | GPU Drivers: An app may be able to cause unexpected system termination | 5.5 | 0.0014 | | | [CVE-2025-43451](https://patchblox.com/security/data/cve/CVE-2025-43451.md) | Routine | AWD: An app may be able to access sensitive user data | 5.5 | 0.0014 | | | [CVE-2025-43290](https://patchblox.com/security/data/cve/CVE-2025-43290.md) | Routine | CoreServices: An app may be able to modify protected parts of the file system | 5.5 | 0.0013 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.