visionOS 26.5 Security Update Advisory: Fixes Memory Corruption and Kernel CVEs

visionOS 26.5 Security Summary Vulnerability Overview Apple has released the visionOS 26.5 security update, addressing multiple security vulnerabilities. These vulnerabilities involve various types, including memory corruption, privilege bypasses, and information disclosure. Some of these vulnerabilities could potentially be exploited by malicious applications to execute code, steal data, or cause system crashes. Affected Scope Affected Devices: All models of Apple Vision Pro Affected Components: System components such as Accelerate, Accounts, APFS, App Intents, AppleJPEG, Audio, CoreAnimation, CoreServices, CoreSymbolication, FileProvider, ImageIO, IOHIDFamily, IOKit, Kernel, LaunchServices, mDNSResponder, Model I/O, Networking, SceneKit, Shortcuts, Spotlight, Status Bar, Storage, WebKit, and others Remediation Install the visionOS 26.5 update Update release date: May 11, 2026 Key Vulnerability Details High Severity Vulnerabilities 1. App Intents (CVE-2026-28995) - Impact: Malicious apps may break out of the sandbox - Fix: Improved app sandboxing constraints 2. AppleJPEG (CVE-2026-1637) - Impact: Processing maliciously crafted images may lead to denial of service - Note: A vulnerability in open-source code; Apple Software is one of the affected projects 3. Audio (CVE-2026-39869) - Impact: Processing audio streams in maliciously crafted media files may terminate the process - Fix: Improved memory handling 4. ImageIO (CVE-2026-28977) - Impact: Processing maliciously crafted files may cause unexpected app termination - Fix: Improved bounds checking 5. ImageIO (CVE-2026-28990) - Impact: Processing maliciously crafted images may corrupt process memory - Fix: Improved memory handling 6. IOHIDFamily (CVE-2026-28992) - Impact: An attacker may cause unexpected app termination - Fix: Improved locking mechanisms 7. Kernel (CVE-2026-28907) - Impact: Local users may cause unexpected system termination or read kernel memory - Fix: Improved input validation 8. Kernel (CVE-2026-28972) - Impact: May cause unexpected system termination or write to kernel memory - Fix: Improved input validation 9. mDNSResponder (CVE-2026-43668) - Impact: An attacker may cause unexpected app termination or corrupt kernel memory - Fix: Improved memory management 10. mDNSResponder (CVE-2026-43666) - Impact: An attacker on the local network may cause denial of service - Fix: Improved bounds checking 11. SceneKit (CVE-2026-28846) - Impact: A remote attacker may cause unexpected app termination - Fix: Improved bounds checking 12. Spotlight (CVE-2026-28974) - Impact: An app may cause denial of service - Fix: Improved checks to prevent unauthorized operations 13. WebKit (CVE-2026-43660) - Impact: Processing maliciously crafted web content may disable Content Security Policy (CSP) enforcement - Fix: Improved logic validation Medium Severity Vulnerabilities 1. Accelerate (CVE-2026-28991) - Impact: An app may cause denial of service - Fix: Improved bounds checking 2. Accounts (CVE-2026-28988) - Impact: An app may bypass certain privacy preference settings - Fix: Added additional restrictions 3. APFS (CVE-2026-28959) - Impact: An app may cause unexpected system termination - Fix: Improved bounds checking 4. CoreAnimation (CVE-2026-28964) - Impact: An app may access sensitive user data - Fix: Improved state management 5. CoreServices (CVE-2026-28936) - Impact: Processing maliciously crafted files may cause unexpected app termination - Fix: Improved checks 6. CoreSymbolication (CVE-2026-28918) - Impact: Processing maliciously crafted files may cause unexpected app termination - Fix: Improved bounds checking 7. FileProvider (CVE-2026-43659) - Impact: An app may access sensitive user data - Fix: Added additional validation 8. IOKit (CVE-2026-28969) - Impact: An app may cause unexpected system termination - Fix: Improved memory management 9. Kernel (CVE-2026-43654) - Impact: An app may leak kernel memory - Fix: Improved memory handling 10. LaunchServices (CVE-2026-28983) - Impact: A remote attacker may cause denial of service - Fix: Improved checks 11. Model I/O (CVE-2026-28940) - Impact: Processing maliciously crafted images may corrupt process memory - Fix: Improved memory handling 12. Networking (CVE-2026-28906) - Impact: An attacker may track users via IP address - Fix: Improved state management 13. Shortcuts (CVE-2026-28993) - Impact: An app may access sensitive user data - Fix: Added extra prompts for user consent 14. Status Bar (CVE-2026-28957) - Impact: An app may capture the user’s screen - Fix: Improved logic 15. Storage (CVE-2026-28996) - Impact: An app may access sensitive user data - Fix: Added additional validation 16. WebKit (CVE-2026-43660) - Impact: Processing maliciously crafted web content may disable Content Security Policy (CSP) enforcement - Fix: Improved logic validation Vulnerability Contributors Seiji Sakurai (@HeapSmasher) Asaf Cohen Dave G. Vamshi Paill, Tony Gorez (@tonygo_j) for Reverse Society David Ige of Beryllium Security Ala

Goal Reached Thanks to every supporter — we hit 100%!

visionOS 26.5 Security Update Advisory: Fixes Memory Corruption and Kernel CVEs