macOS Sequoia 15.7.7 Security Update Vulnerability Summary

macOS Sequoia 15.7.7 Security Update Vulnerability Summary Vulnerability Overview Apple has released the macOS Sequoia 15.7.7 security update, addressing security vulnerabilities in multiple components, including buffer overflows, memory corruption, privilege escalation, sandbox escapes, and other issues. Impact Scope Affected Systems: macOS Sequoia Release Date: May 11, 2026 Remediation All vulnerabilities have been addressed through the security update. Users are advised to install macOS Sequoia 15.7.7 immediately. Detailed Vulnerability List APFS CVE-2026-28959 - Impact: An application may cause unexpected system termination - Description: A buffer overflow issue was addressed with improved bounds checking - Reporter: Dave G. AppleJPEG CVE-2026-28956 - Impact: Processing a maliciously crafted media file may lead to application termination or memory corruption - Description: A memory corruption issue was addressed with improved input validation - Reporter: impost0r (ret2plt) Audio CVE-2026-39869 - Impact: Processing an audio stream in a maliciously crafted media file may lead to process termination - Description: The issue was addressed with improved memory handling - Reporter: David Ige of Beryllium Security CoreMedia CVE-2026-28922 - Impact: An application may be able to access private information - Description: The issue was addressed with improved state management - Reporter: Arni Hardarson Crash Reporter CVE-2026-28878 - Impact: An application may be able to enumerate user-installed apps - Description: A privacy issue was addressed by removing sensitive data - Reporter: Zhongcheng Li from IES Red Team CUPS CVE-2026-28915 - Impact: An application may be able to gain root privileges - Description: A parsing issue in directory path handling was addressed with improved path validation - Reporter: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs FileProvider CVE-2026-43659 - Impact: An application may be able to access sensitive user data - Description: A race condition was addressed with additional validation - Reporter: Alex Radocea GPU Drivers CVE-2026-28923 - Impact: A malicious application may be able to break out of its sandbox - Description: A logging issue was addressed with improved data redaction - Reporter: Kun Peeks (@SwayZQftZyyy) HFS CVE-2026-28925 - Impact: An application may cause unexpected system termination or write to kernel memory - Description: A buffer overflow issue was addressed with improved bounds checking - Reporter: Dave G., Aswin Kumar Gokula Kannan Icons CVE-2025-43524 - Impact: An application may be able to break out of its sandbox - Description: An access issue was addressed with additional sandbox restrictions - Reporter: Csaba Fitzl (@theevilbit) of Iru ImageIO CVE-2026-28977 - Impact: Processing a maliciously crafted file may lead to unexpected application termination - Description: The issue was addressed with improved bounds checking - Reporter: Suresh Sundaram ImageIO CVE-2026-28990 - Impact: Processing a maliciously crafted image may corrupt process memory - Description: The issue was addressed with improved memory handling - Reporter: Jiri Ha, Arni Hardarson Installer CVE-2026-28978 - Impact: A malicious application may be able to break out of its sandbox - Description: A permissions issue was addressed with additional restrictions - Reporter: wdsszml and Atuin Automated Vulnerability Discovery Engine IOHIDFamily CVE-2026-28992 - Impact: An attacker may cause an application to terminate unexpectedly - Description: A memory corruption vulnerability was addressed with improved locking - Reporter: Johnny Franks (@zeroxf) IOHIDFamily CVE-2026-28943 - Impact: An application may be able to determine kernel memory layout - Description: A logging issue was addressed with improved data redaction - Reporter: Google Threat Analysis Group IOKit CVE-2026-28969 - Impact: An application may cause unexpected system termination - Description: A use-after-free issue was addressed with improved memory management - Reporter: Mihalis Haatalainen, Ari Hawking, Ashish Kunwar Kernel CVE-2026-43654 - Impact: An application may be able to leak kernel memory - Description: The issue was addressed with improved memory handling - Reporter: Vaagn Vardanian, Nathaniel Oh (@calysteon) Kernel CVE-2026-28954 - Impact: A maliciously crafted disk image may bypass Gatekeeper checks - Description: A file quarantine bypass was addressed with additional checks - Reporter: Yiğit Can YILMAZ (@yilmazcanyigit) Kernel CVE-2026-28897 - Impact: A local user may cause unexpected system termination or read kernel memory - Description: A buffer overflow issue was addressed with improved input validation - Reporter: Robert Tran, popku1337, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Aswin kumar Gokulakannan Kernel CVE-2026-28952 - Impact: An application may cause unexpected system termination - Description: An integer overflow issue was addressed with improved input val

Goal Reached Thanks to every supporter — we hit 100%!

macOS Sequoia 15.7.7 Security Update Vulnerability Summary