# Tahoe 26.1 Tahoe 26.1, released November 3, 2025, fixes 101 CVEs in Tahoe. 2 of them are being exploited (CVE-2025-43520); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/macos/tahoe-26.1 - Platform: macOS - Released: Nov 3, 2025 - Priority: Patch now (Closes CVE-2025-43520, exploited (CISA KEV)) - CVEs: 101, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.apple.com/en-us/125634 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Tahoe](https://patchblox.com/security/data/product/macos/tahoe.md) | | 26.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2025-43520](https://patchblox.com/security/data/cve/CVE-2025-43520.md) | Patch now | Kernel: A malicious application may be able to cause unexpected system termination or write kernel memory | 5.5 | 0.0043 | CISA KEV | | [CVE-2025-43510](https://patchblox.com/security/data/cve/CVE-2025-43510.md) | Patch now | Kernel: A malicious application may cause unexpected changes in memory shared between processes | 7.8 | 0.0036 | CISA KEV | | [CVE-2025-30465](https://patchblox.com/security/data/cve/CVE-2025-30465.md) | Urgent | Shortcuts: A shortcut may be able to access files that are normally inaccessible to the Shortcuts app | 9.8 | 0.0107 | | | [CVE-2025-32462](https://patchblox.com/security/data/cve/CVE-2025-32462.md) | High | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL | 8.8 | 0.0448 | | | [CVE-2025-43429](https://patchblox.com/security/data/cve/CVE-2025-43429.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0145 | | | [CVE-2024-49761](https://patchblox.com/security/data/cve/CVE-2024-49761.md) | High | Ruby: Multiple issues in ruby | 7.5 | 0.0142 | | | [CVE-2025-43433](https://patchblox.com/security/data/cve/CVE-2025-43433.md) | High | WebKit: Processing maliciously crafted web content may lead to memory corruption | 8.8 | 0.0117 | | | [CVE-2025-43438](https://patchblox.com/security/data/cve/CVE-2025-43438.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected Safari crash | 8.8 | 0.0111 | | | [CVE-2025-43401](https://patchblox.com/security/data/cve/CVE-2025-43401.md) | High | CoreAnimation: A remote attacker may be able to cause a denial-of-service | 7.5 | 0.0103 | | | [CVE-2025-43441](https://patchblox.com/security/data/cve/CVE-2025-43441.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0096 | | | [CVE-2025-43432](https://patchblox.com/security/data/cve/CVE-2025-43432.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0084 | | | [CVE-2025-43443](https://patchblox.com/security/data/cve/CVE-2025-43443.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0072 | | | [CVE-2025-43421](https://patchblox.com/security/data/cve/CVE-2025-43421.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0064 | | | [CVE-2025-43413](https://patchblox.com/security/data/cve/CVE-2025-43413.md) | High | libxpc: A sandboxed app may be able to observe system-wide network connections | 7.5 | 0.0063 | | | [CVE-2025-43458](https://patchblox.com/security/data/cve/CVE-2025-43458.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0061 | | | [CVE-2025-43399](https://patchblox.com/security/data/cve/CVE-2025-43399.md) | High | Siri: An app may be able to access protected user data | 7.5 | 0.0059 | | | [CVE-2025-43405](https://patchblox.com/security/data/cve/CVE-2025-43405.md) | High | Photos: An app may be able to access user-sensitive data | 7.5 | 0.0059 | | | [CVE-2025-43436](https://patchblox.com/security/data/cve/CVE-2025-43436.md) | High | CoreServices: An app may be able to enumerate a user's installed apps | 7.5 | 0.0058 | | | [CVE-2025-43494](https://patchblox.com/security/data/cve/CVE-2025-43494.md) | High | Mail: An attacker may be able to cause a persistent denial-of-service | 7.5 | 0.0057 | | | [CVE-2025-43496](https://patchblox.com/security/data/cve/CVE-2025-43496.md) | High | Mail Drafts: Remote content may be loaded even when the 'Load Remote Images' setting is turned off | 7.5 | 0.0052 | | | [CVE-2025-43500](https://patchblox.com/security/data/cve/CVE-2025-43500.md) | High | Sandbox Profiles: An app may be able to access sensitive user data | 7.5 | 0.0052 | | | [CVE-2025-43440](https://patchblox.com/security/data/cve/CVE-2025-43440.md) | High | WebKit: Processing maliciously crafted web content may lead to an unexpected process crash | 8.8 | 0.0051 | | | [CVE-2025-43392](https://patchblox.com/security/data/cve/CVE-2025-43392.md) | High | WebKit Canvas: A website may exfiltrate image data cross-origin | 8.8 | 0.0050 | | | [CVE-2025-43480](https://patchblox.com/security/data/cve/CVE-2025-43480.md) | High | WebKit: A malicious website may exfiltrate data cross-origin | 8.8 | 0.0049 | | | [CVE-2025-43373](https://patchblox.com/security/data/cve/CVE-2025-43373.md) | High | Wi-Fi: An app may be able to cause unexpected system termination or corrupt kernel memory | 7.5 | 0.0049 | | | [CVE-2025-43502](https://patchblox.com/security/data/cve/CVE-2025-43502.md) | High | Safari: An app may be able to bypass certain Privacy preferences | 7.5 | 0.0047 | | | [CVE-2025-43506](https://patchblox.com/security/data/cve/CVE-2025-43506.md) | High | Networking: iCloud Private Relay may not activate when more than one user is logged in at the same time | 7.5 | 0.0047 | | | [CVE-2025-46315](https://patchblox.com/security/data/cve/CVE-2025-46315.md) | High | Disk Images: An app may be able to access protected user data | 7.5 | 0.0027 | | | [CVE-2025-43386](https://patchblox.com/security/data/cve/CVE-2025-43386.md) | High | Model I/O: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 7.8 | 0.0023 | | | [CVE-2025-43402](https://patchblox.com/security/data/cve/CVE-2025-43402.md) | High | WindowServer: An app may be able to cause unexpected system termination or corrupt process memory | 7.8 | 0.0022 | | | [CVE-2025-43476](https://patchblox.com/security/data/cve/CVE-2025-43476.md) | High | SharedFileList: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43407](https://patchblox.com/security/data/cve/CVE-2025-43407.md) | High | Assets: An app may be able to break out of its sandbox | 7.8 | 0.0020 | | | [CVE-2025-43472](https://patchblox.com/security/data/cve/CVE-2025-43472.md) | High | zsh: An app may be able to gain root privileges | 7.8 | 0.0020 | | | [CVE-2025-43474](https://patchblox.com/security/data/cve/CVE-2025-43474.md) | High | GPU Drivers: An app may be able to cause unexpected system termination or read kernel memory | 7.8 | 0.0020 | | | [CVE-2025-43467](https://patchblox.com/security/data/cve/CVE-2025-43467.md) | High | Installer: An app may be able to gain root privileges | 7.8 | 0.0019 | | | [CVE-2025-43364](https://patchblox.com/security/data/cve/CVE-2025-43364.md) | High | NetFSFramework: An app may be able to break out of its sandbox | 7.8 | 0.0018 | | | [CVE-2025-43387](https://patchblox.com/security/data/cve/CVE-2025-43387.md) | High | DiskArbitration: A malicious app may be able to gain root privileges | 7.8 | 0.0017 | | | [CVE-2024-43398](https://patchblox.com/security/data/cve/CVE-2024-43398.md) | Routine | Ruby: Multiple issues in ruby | 5.9 | 0.0121 | | | [CVE-2025-43445](https://patchblox.com/security/data/cve/CVE-2025-43445.md) | Routine | CoreText: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory | 4.3 | 0.0112 | | | [CVE-2025-53906](https://patchblox.com/security/data/cve/CVE-2025-53906.md) | Routine | Vim has path traversal issue with zip.vim and special crafted zip archives | 4.1 | 0.0087 | | | [CVE-2025-43444](https://patchblox.com/security/data/cve/CVE-2025-43444.md) | Routine | Installer: An app may be able to fingerprint the user | 5.3 | 0.0054 | | | [CVE-2025-6442](https://patchblox.com/security/data/cve/CVE-2025-6442.md) | Routine | Ruby: Multiple issues in ruby | 6.5 | 0.0050 | | | [CVE-2025-43503](https://patchblox.com/security/data/cve/CVE-2025-43503.md) | Routine | Safari: Visiting a malicious website may lead to user interface spoofing | 4.3 | 0.0042 | | | [CVE-2025-43493](https://patchblox.com/security/data/cve/CVE-2025-43493.md) | Routine | Safari: Visiting a malicious website may lead to address bar spoofing | 4.3 | 0.0039 | | | [CVE-2025-43464](https://patchblox.com/security/data/cve/CVE-2025-43464.md) | Routine | dyld: Visiting a website may lead to an app denial-of-service | 6.5 | 0.0038 | | | [CVE-2025-43507](https://patchblox.com/security/data/cve/CVE-2025-43507.md) | Routine | Find My: An app may be able to fingerprint the user | 6.5 | 0.0038 | | | [CVE-2025-46316](https://patchblox.com/security/data/cve/CVE-2025-46316.md) | Routine | QuickLook: Processing a maliciously crafted Pages document may result in unexpected termination or disclosure of process memory | 4.3 | 0.0032 | | | [CVE-2025-43448](https://patchblox.com/security/data/cve/CVE-2025-43448.md) | Routine | CloudKit: An app may be able to break out of its sandbox | 6.3 | 0.0032 | | | [CVE-2025-43424](https://patchblox.com/security/data/cve/CVE-2025-43424.md) | Routine | Multi-Touch: A malicious HID device may cause an unexpected process crash | 6.5 | 0.0030 | | | [CVE-2025-43426](https://patchblox.com/security/data/cve/CVE-2025-43426.md) | Routine | Contacts: An app may be able to access sensitive user data | 5.5 | 0.0028 | | | [CVE-2025-43455](https://patchblox.com/security/data/cve/CVE-2025-43455.md) | Routine | Apple Account: A malicious app may be able to take a screenshot of sensitive information in embedded views | 5.5 | 0.0026 | | | [CVE-2025-43408](https://patchblox.com/security/data/cve/CVE-2025-43408.md) | Routine | Share Sheet: An attacker with physical access may be able to access contacts from the lock screen | 2.4 | 0.0026 | | | [CVE-2025-43394](https://patchblox.com/security/data/cve/CVE-2025-43394.md) | Routine | bootp: An app may be able to access protected user data | 5.5 | 0.0025 | | | [CVE-2025-43423](https://patchblox.com/security/data/cve/CVE-2025-43423.md) | Routine | Audio: An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging | 2.0 | 0.0025 | | | [CVE-2025-43348](https://patchblox.com/security/data/cve/CVE-2025-43348.md) | Routine | Finder: An app may bypass Gatekeeper checks | 5.5 | 0.0024 | | | [CVE-2025-43446](https://patchblox.com/security/data/cve/CVE-2025-43446.md) | Routine | Assets: An app may be able to modify protected parts of the file system | 5.5 | 0.0023 | | | [CVE-2025-43395](https://patchblox.com/security/data/cve/CVE-2025-43395.md) | Routine | configd: An app may be able to access protected user data | 3.3 | 0.0022 | | | [CVE-2025-43382](https://patchblox.com/security/data/cve/CVE-2025-43382.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43378](https://patchblox.com/security/data/cve/CVE-2025-43378.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43463](https://patchblox.com/security/data/cve/CVE-2025-43463.md) | Routine | StorageKit: An app may be able to access sensitive user data | 5.5 | 0.0022 | | | [CVE-2025-43388](https://patchblox.com/security/data/cve/CVE-2025-43388.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 3.3 | 0.0022 | | | [CVE-2025-43379](https://patchblox.com/security/data/cve/CVE-2025-43379.md) | Routine | AppleMobileFileIntegrity: An app may be able to access protected user data | 5.5 | 0.0021 | | | [CVE-2025-43322](https://patchblox.com/security/data/cve/CVE-2025-43322.md) | Routine | Admin Framework: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43334](https://patchblox.com/security/data/cve/CVE-2025-43334.md) | Routine | sudo: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43335](https://patchblox.com/security/data/cve/CVE-2025-43335.md) | Routine | Security: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43411](https://patchblox.com/security/data/cve/CVE-2025-43411.md) | Routine | PackageKit: An app may be able to access user-sensitive data | 5.5 | 0.0021 | | | [CVE-2025-43479](https://patchblox.com/security/data/cve/CVE-2025-43479.md) | Routine | CoreServices: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43391](https://patchblox.com/security/data/cve/CVE-2025-43391.md) | Routine | Photos: An app may be able to access sensitive user data | 5.5 | 0.0021 | | | [CVE-2025-43409](https://patchblox.com/security/data/cve/CVE-2025-43409.md) | Routine | Spotlight: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43336](https://patchblox.com/security/data/cve/CVE-2025-43336.md) | Routine | SoftwareUpdate: An app with root privileges may be able to access private information | 4.4 | 0.0020 | | | [CVE-2025-43398](https://patchblox.com/security/data/cve/CVE-2025-43398.md) | Routine | Kernel: An app may be able to cause unexpected system termination | 5.5 | 0.0020 | | | [CVE-2025-43380](https://patchblox.com/security/data/cve/CVE-2025-43380.md) | Routine | sips: Parsing a file may lead to an unexpected app termination | 5.5 | 0.0020 | | | [CVE-2025-43406](https://patchblox.com/security/data/cve/CVE-2025-43406.md) | Routine | Sandbox: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43396](https://patchblox.com/security/data/cve/CVE-2025-43396.md) | Routine | Installer: A sandboxed app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43461](https://patchblox.com/security/data/cve/CVE-2025-43461.md) | Routine | configd: An app may be able to access protected user data | 5.5 | 0.0020 | | | [CVE-2025-43477](https://patchblox.com/security/data/cve/CVE-2025-43477.md) | Routine | Siri: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43381](https://patchblox.com/security/data/cve/CVE-2025-43381.md) | Routine | CoreServicesUIAgent: A malicious app may be able to delete protected user data | 5.5 | 0.0020 | | | [CVE-2025-43498](https://patchblox.com/security/data/cve/CVE-2025-43498.md) | Routine | FileProvider: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43473](https://patchblox.com/security/data/cve/CVE-2025-43473.md) | Routine | Shortcuts: An app may be able to access sensitive user data | 5.5 | 0.0020 | | | [CVE-2025-43389](https://patchblox.com/security/data/cve/CVE-2025-43389.md) | Routine | Notes: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43447](https://patchblox.com/security/data/cve/CVE-2025-43447.md) | Routine | Apple Neural Engine: An app may be able to cause unexpected system termination or corrupt kernel memory | 5.5 | 0.0019 | | | [CVE-2025-43465](https://patchblox.com/security/data/cve/CVE-2025-43465.md) | Routine | ATS: An app may be able to access sensitive user data | 3.3 | 0.0019 | | | [CVE-2025-43377](https://patchblox.com/security/data/cve/CVE-2025-43377.md) | Routine | Model I/O: An app may be able to cause a denial-of-service | 5.5 | 0.0019 | | | [CVE-2025-43499](https://patchblox.com/security/data/cve/CVE-2025-43499.md) | Routine | Shortcuts: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43469](https://patchblox.com/security/data/cve/CVE-2025-43469.md) | Routine | NSSpellChecker: An app may be able to access sensitive user data | 5.5 | 0.0019 | | | [CVE-2025-43397](https://patchblox.com/security/data/cve/CVE-2025-43397.md) | Routine | SoftwareUpdate: An app may be able to cause a denial-of-service | 5.5 | 0.0018 | | | [CVE-2025-43478](https://patchblox.com/security/data/cve/CVE-2025-43478.md) | Routine | ASP TCP: An app may be able to cause unexpected system termination | 5.5 | 0.0018 | | | [CVE-2025-43471](https://patchblox.com/security/data/cve/CVE-2025-43471.md) | Routine | Admin Framework: An app may be able to access sensitive user data | 5.5 | 0.0018 | | | [CVE-2025-43412](https://patchblox.com/security/data/cve/CVE-2025-43412.md) | Routine | TCC: An app may be able to break out of its sandbox | 6.3 | 0.0018 | | | [CVE-2025-43351](https://patchblox.com/security/data/cve/CVE-2025-43351.md) | Routine | StorageKit: An app may be able to access protected user data | 5.5 | 0.0017 | | | [CVE-2025-43508](https://patchblox.com/security/data/cve/CVE-2025-43508.md) | Routine | Phone: An app may be able to access sensitive user data | 5.5 | 0.0016 | | | [CVE-2025-43404](https://patchblox.com/security/data/cve/CVE-2025-43404.md) | Routine | Sandbox: An app may be able to access sensitive user data | 3.3 | 0.0016 | | | [CVE-2025-43481](https://patchblox.com/security/data/cve/CVE-2025-43481.md) | Routine | Disk Images: An app may be able to break out of its sandbox | 5.2 | 0.0016 | | | [CVE-2025-43393](https://patchblox.com/security/data/cve/CVE-2025-43393.md) | Routine | quarantine: An app may be able to break out of its sandbox | 5.2 | 0.0015 | | | [CVE-2025-43497](https://patchblox.com/security/data/cve/CVE-2025-43497.md) | Routine | BackBoardServices: An app may be able to break out of its sandbox | 5.2 | 0.0015 | | | [CVE-2025-43390](https://patchblox.com/security/data/cve/CVE-2025-43390.md) | Routine | AppleMobileFileIntegrity: An app may be able to access user-sensitive data | 5.5 | 0.0014 | | | [CVE-2025-43420](https://patchblox.com/security/data/cve/CVE-2025-43420.md) | Routine | Dock: An app may be able to access sensitive user data | 4.7 | 0.0014 | | | [CVE-2025-43470](https://patchblox.com/security/data/cve/CVE-2025-43470.md) | Routine | Disk Images: A standard user may be able to view files made from a disk image belonging to an administrator | 5.5 | 0.0013 | | | [CVE-2025-46313](https://patchblox.com/security/data/cve/CVE-2025-46313.md) | Routine | App Store: An app may be able to access sensitive user data | 5.5 | 0.0013 | | | [CVE-2025-43468](https://patchblox.com/security/data/cve/CVE-2025-43468.md) | Routine | AppleMobileFileIntegrity: An app may be able to access sensitive user data | 5.5 | 0.0013 | | | [CVE-2025-43339](https://patchblox.com/security/data/cve/CVE-2025-43339.md) | Routine | Sandbox: A malicious app may be able to access sensitive user data | 5.5 | 0.0011 | | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.