Apple watchOS 26.5 Security Update Advisory

watchOS 26.5 Security Update Summary Vulnerability Overview Apple has released the watchOS 26.5 security update, addressing multiple security vulnerabilities. These vulnerabilities involve various types, including memory corruption, permission bypass, sandbox escape, and information disclosure. Some vulnerabilities could lead to denial of service, code execution, or sensitive data leakage. Affected Scope Affected Devices: Apple Watch Series 6 and later models Release Date: May 11, 2026 Remediation Installing the watchOS 26.5 update will fix all listed vulnerabilities. Detailed Vulnerability List Accelerate CVE-2026-28991 - Impact: An application may cause a denial of service - Description: Out-of-bounds read issue, resolved with improved bounds checking - Reported by: Seiji Sakurai (@HeapSmasher) Accounts CVE-2026-28988 - Impact: An application may bypass privacy preferences - Description: Permission issue, resolved with additional restrictions - Reported by: Asaf Cohen APFS CVE-2026-28959 - Impact: An application may cause unexpected system termination - Description: Buffer overflow, resolved with improved bounds checking - Reported by: Dave G. App Intents CVE-2026-28995 - Impact: A malicious application may escape the sandbox - Description: Logic issue, resolved with improved restrictions - Reported by: Vamshi Palli, Tony Gorez (@tonygo_) for Reverse Society AppleJPEG CVE-2026-1837 - Impact: Processing a maliciously crafted image may lead to denial of service - Description: Vulnerability in open-source code; Apple Software is one of the affected projects - Reported by: Third-party assignment CVE-2026-28956 - Impact: Processing a maliciously crafted media file may lead to unexpected application termination or memory corruption - Description: Memory corruption issue, resolved with improved input validation - Reported by: impost0r (ret2ptt) Audio CVE-2026-39869 - Impact: Processing an audio stream in a maliciously crafted media file may terminate a process - Description: Memory handling issue, resolved with improved memory handling - Reported by: David Ige of Beryllium Security CoreSymbolication CVE-2026-28918 - Impact: Parsing a maliciously crafted file may lead to unexpected application termination - Description: Out-of-bounds access issue, resolved with improved bounds checking - Reported by: Niels Hofmans, Anonymous working with TrendAI Zero Day Initiative ImageIO CVE-2026-43661 - Impact: Processing a maliciously crafted image may corrupt process memory - Description: Buffer overflow issue, resolved with improved memory handling - Reported by: Anonymous researcher CVE-2026-28977 - Impact: Processing a maliciously crafted file may lead to unexpected application termination - Description: Issue resolved with improved bounds checking - Reported by: Suresh Sundaram CVE-2026-28990 - Impact: Processing a maliciously crafted image may corrupt process memory - Description: Issue resolved with improved memory handling - Reported by: Jiri Ha, Ami Hardarson IOHIDFamily CVE-2026-28992 - Impact: An attacker may cause unexpected application termination - Description: Memory corruption vulnerability, resolved with improved locking - Reported by: Johnny Franks (@zeroxf) CVE-2026-28943 - Impact: An application may determine the kernel memory layout - Description: Logging issue, resolved with improved data redaction - Reported by: Google Threat Analysis Group IOKit CVE-2026-28969 - Impact: An application may cause unexpected system termination - Description: Use-after-free issue, resolved with improved memory management - Reported by: Mihalis Haatainen, Ari Hawking, Ashish Kunwar IOSurfaceAccelerator CVE-2026-43655 - Impact: An application may cause unexpected system termination or read kernel memory - Description: Out-of-bounds read issue, resolved with improved bounds checking - Reported by: Somair Ansar and an anonymous researcher Kernel CVE-2026-43654 - Impact: An application may leak kernel memory - Description: Issue resolved with improved memory handling - Reported by: Vaagn Vardanian, Nathaniel Oh (@calysteon) CVE-2026-28897 - Impact: A local user may cause unexpected system termination or read kernel memory - Description: Buffer overflow issue, resolved with improved input validation - Reported by: popku1337, Billy Jheng Bing Jhong, Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Aswin kumar Gokulakannan CVE-2026-28972 - Impact: An application may cause unexpected system termination or write to kernel memory - Description: Out-of-bounds write issue, resolved with improved input validation - Reported by: Billy Jheng Bing Jhong, Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Ryan Hileman via Xint Code (xint.io) CVE-2026-28986 - Impact: An application may cause unexpected system termination - Description: Race condition issue, resolved with additional validation - Reported by: Chris Betz, Tristan Madani (@TristanInSec) from Talence Security, Ryan Hileman via Xint Code (xint.io) CVE-2026

Goal Reached Thanks to every supporter — we hit 100%!

Apple watchOS 26.5 Security Update Advisory