Apple published a security content page for macOS Tahoe on July 28, 2026, documenting more than a dozen patched vulnerabilities spanning kernel memory corruption, sandbox escapes, privilege escalation, and user-data access flaws. The page, hosted at support.apple.com, lists fixes credited to both independent researchers and organized security teams.

The most severe class of bugs in this batch targets kernel memory. The kernel is the core of the operating system — the layer that manages hardware, memory, and process security — so bugs in this area are especially dangerous. CVE-2026-64767, a buffer overflow (a flaw where a program writes more data than a memory location can hold) reported by Dave G., could allow a remote attacker to crash the system or corrupt kernel memory. CVE-2026-64695, a memory-handling issue reported by Peter Malone, carries the same impact through a remote user. CVE-2026-43681, reported by impost0r (ret2plt) and David Ige of Beryllium Security, could let a local user read kernel memory directly. And CVE-2026-43776, reported by Irvin Wang, Peter Malone, and Nicolas Rabrenovic, is a buffer overflow triggered by processing a maliciously crafted file that could lead to arbitrary code execution — meaning an attacker could run whatever code they wanted on the machine. Apple addressed all of these with improved memory handling and bounds checking.

Two vulnerabilities enable privilege escalation, which means an attacker or app could gain higher access rights than they should have. CVE-2026-43749, a directory-path parsing issue reported by Adam Franke, Ashish Kunwar, and Trung Nguyen of CyStack, could allow an app to gain root privileges — the highest level of access on the system. Apple patched it with improved path validation. CVE-2026-43748, an out-of-bounds write (writing data outside the intended memory boundary) reported by an anonymous researcher, tamdao, and Franco Belman of Blackwing Intelligence, could cause unexpected system termination. CVE-2026-28928, a use-after-free issue — where a program keeps using memory after it has been freed — reported by Dun, shares that termination impact.

Sandbox integrity received particular attention. A sandbox is a security mechanism that restricts what an app can do, isolating it from the rest of the system. CVE-2026-64737, reported by Robert Mindo, could allow a malicious app to break out of its sandbox entirely. CVE-2026-43819, reported by Omar Cerrito, involved an access issue that could have let an app reach sensitive user data; Apple addressed it with additional sandbox restrictions. The security content page also references an incomplete entry for a sandbox file-read vulnerability addressed by removing vulnerable code, though the CVE identifier was truncated in Apple's published output.

Several entries concern user-data access and privacy bypass. CVE-2026-43801, reported by Rahul Raj, stems from insufficient checks that could allow an app to access sensitive user data. CVE-2026-43781, a race condition (where the timing of operations leads to unintended behavior) reported by Pinak Oza, could allow the same through improper state handling. CVE-2026-43672, reported by Lee Jaeyeong, is an authorization issue that could let a malicious application bypass Privacy preferences. And CVE-2026-64733, reported by Rosyna Keller of Totally Not Malicious Software, is a data-protection issue that could allow an app to fingerprint the user — collecting identifying details about the device or its owner — addressed with improved data protection.

CVE-2026-23918, reported by Yulia Mertsalova, is a denial-of-service vulnerability in open-source code affecting macOS Tahoe. Its CVE was assigned by a third party rather than Apple, placing it in a category the company handles differently in its disclosure process.

The researcher roster is notable for its breadth. Named contributors include independent researchers, members of security firms (CyStack, Beryllium Security, Blackwing Intelligence), and at least one anonymous submitter. The presence of multiple researchers reporting distinct kernel memory bugs in a single update cycle suggests sustained external scrutiny of macOS Tahoe's kernel surface area.

The vulnerability profile here is consistent with what security teams have come to expect from major macOS releases: a mix of memory-safety bugs in kernel-adjacent code, sandbox boundary issues, and data-access flaws that bypass privacy controls. The kernel memory corruption and arbitrary code execution entries carry the highest severity, since they require only a malicious file or remote interaction to trigger. The sandbox escape and root-privilege escalation bugs are lower-probability but higher-impact in targeted scenarios, because they require local code execution as a prerequisite.

The broader context worth flagging here is that the fingerprinting vulnerability (CVE-2026-64733) and the Privacy preferences bypass (CVE-2026-43672) belong to a category of flaw that is often lower on patch priority lists in enterprise environments, where kernel and privilege bugs dominate. But for privacy-sensitive deployments, including regulated industries where device fingerprinting has compliance implications, these patches merit the same urgency.

Apple's security content pages have historically served as the canonical reference for what each macOS update fixes, and this Tahoe entry follows that format. The page does not include exploit-in-the-wild status for any of the listed CVEs, which is information Apple typically reserves for actively exploited vulnerabilities. Organizations running macOS Tahoe should treat the full update as a baseline requirement rather than triaging individual CVEs.