Apple tvOS 26.5 Security Update Summary

tvOS 26.5 Security Update Summary Vulnerability Overview Apple released the tvOS 26.5 security update, which addresses multiple security vulnerabilities. These vulnerabilities span various types, including memory corruption, out-of-bounds access, privilege escalation, and denial of service. Some of these vulnerabilities could be maliciously exploited to cause system crashes or data leaks. Scope of Impact Affected Devices: Apple TV HD and Apple TV 4K (all models) Vulnerable Components: - Accelerate - APFS - App Intents - AppleJPEG (2 vulnerabilities) - Audio - CoreSymbolication - ImageIO (3 vulnerabilities) - IOHIDFamily (2 vulnerabilities) - IOKit - IOSurfaceAccelerator - Kernel (4 vulnerabilities) - LaunchServices - mDNSResponder (4 vulnerabilities) - Model I/O - SceneKit - Spotlight - Storage - WebKit (2 vulnerabilities) Remediation All vulnerabilities have been resolved in the tvOS 26.5 update. Users are advised to update to the latest version immediately. Updates can be installed via the Software Update feature in System Settings. Key Vulnerability Details Memory Safety Issues: Multiple components contain vulnerabilities such as buffer overflows, out-of-bounds reads/writes, and memory corruption. Privilege Escitation: Vulnerabilities in App Intents may allow applications to bypass sandbox restrictions. Denial of Service: Multiple components contain vulnerabilities that can cause system or application crashes. Information Disclosure: Kernel vulnerabilities may lead to the leakage of sensitive kernel states. Remote Attacks: Vulnerabilities in mDNSResponder and WebKit may be remotely exploitable. Contributors The vulnerability fixes involve contributions from multiple security researchers and organizations, including Seiji Sakurai, Dave G, Reverse Society, Beryllium Security, TrendAI Zero Day Initiative, Google Threat Analysis Group, STAR Labs SG Pte. Ltd., Talence Security, Hexens, and others.

Goal Reached Thanks to every supporter — we hit 100%!

Apple tvOS 26.5 Security Update Summary