Apple’s May 2026 security update represents one of the most comprehensive patch releases in recent history, addressing 82 unique CVEs across three supported macOS versions. The distribution reveals significant security work across the entire macOS ecosystem, with macOS Tahoe 26.5 receiving fixes for 79 vulnerabilities, macOS Sequoia 15.7.7 addressing 45 issues, and macOS Sonoma 14.8.7 patching 42 flaws. This update was released on May 11, 2026, and includes critical kernel-level vulnerabilities, Wi-Fi component exploits, and extensive WebKit security improvements. The scope encompasses local privilege escalation, remote code execution vectors, memory corruption issues, and sandbox escape mechanisms that could allow attackers to compromise system integrity. Security professionals should prioritize deployment of these patches, particularly for systems running internet-facing services or processing untrusted content.
CVE-2026-28819: Critical Wi-Fi Kernel Privilege Escalation
CVE-2026-28819 stands as the most severe vulnerability in the May 2026 update, representing a critical out-of-bounds write issue in the Wi-Fi component that could allow an application to execute arbitrary code with kernel privileges. This vulnerability affects all three macOS versions including Tahoe, Sequoia, and Sonoma, making it a widespread threat across the entire supported macOS ecosystem. The technical nature of this flaw involves improper bounds checking in kernel memory management, which was addressed through improved input validation. An attacker exploiting this vulnerability could achieve complete system compromise, as kernel-level code execution provides unrestricted access to all system resources, memory, and hardware. The combination of local attack vector with kernel privilege escalation makes this vulnerability particularly dangerous in multi-user environments or systems where untrusted applications might be installed. Apple has assigned this vulnerability critical priority, and organizations should treat patching as urgent. The flaw allows a malicious application to write beyond allocated memory boundaries in the Wi-Fi subsystem, corrupting kernel memory structures and potentially hijacking control flow to execute attacker-controlled code at the highest privilege level.
CVE-2026-43668: Remote mDNSResponder Memory Corruption
CVE-2026-43668 represents a particularly concerning use-after-free vulnerability in mDNSResponder, Apple’s implementation of Multicast DNS and DNS Service Discovery protocols. This flaw allows a remote attacker to cause unexpected system termination or corrupt kernel memory, with a CVSS score of 10.0 indicating maximum severity. The vulnerability’s impact is amplified by the fact that mDNSResponder runs continuously as a system service on all macOS installations, providing a persistent attack surface. The use-after-free condition occurs when code attempts to access memory that has already been deallocated, creating opportunities for memory corruption and potential arbitrary code execution. Apple addressed this issue through improved memory management, specifically implementing safeguards to prevent access to freed memory regions. The remote attack vector distinguishes this vulnerability from many others in the May 2026 update, as exploitation does not require local access or user interaction. Attackers could potentially trigger this vulnerability through maliciously crafted mDNS packets sent over the local network, making it particularly relevant for enterprise environments where network segmentation may be incomplete. The kernel memory corruption aspect means successful exploitation could lead to complete system compromise, data exfiltration, or denial of service.
CVE-2026-28972: Kernel Out-of-Bounds Write Vulnerability
CVE-2026-28972 presents another critical kernel-level threat through an out-of-bounds write issue that enables applications to cause unexpected system termination or write directly to kernel memory. This vulnerability affects all three macOS versions and carries a CVSS 3.1 score of 6.5, classified as medium severity despite its kernel-level impact. The flaw stems from inadequate input validation in kernel code, allowing crafted application requests to write beyond allocated buffer boundaries. Apple’s remediation involved implementing improved input validation mechanisms to ensure all memory write operations remain within properly allocated regions. The technical implications of this vulnerability are significant for security professionals, as direct kernel memory writes can be leveraged to modify critical system structures, bypass security controls, or establish persistence mechanisms. Unlike CVE-2026-28819, which specifically affects the Wi-Fi component, this vulnerability resides in core kernel functionality, potentially offering attackers multiple exploitation paths depending on the specific system calls involved. The ability to write kernel memory represents a severe security breach, as it undermines the fundamental separation between user space and kernel space that forms the basis of operating system security. Security researchers have noted that this vulnerability may have implications for the upcoming Pwn2Own Berlin contest, suggesting it represents a valuable exploitation primitive for chaining with other vulnerabilities.
WebKit Security: Content Security Policy Bypass and Information Disclosure
The May 2026 update addresses approximately 20 WebKit vulnerabilities, with several critical flaws affecting Content Security Policy enforcement and user data protection. CVE-2026-43660 and CVE-2026-28907 represent validation and input validation failures that allow maliciously crafted web content to prevent Content Security Policy from being enforced, undermining a fundamental browser security mechanism designed to prevent cross-site scripting and code injection attacks. CVE-2026-28962 enables disclosure of sensitive user information through maliciously crafted web content, addressed through improved access restrictions. The WebKit vulnerabilities collectively demonstrate the ongoing security challenges in browser engine development, where complex parsing and rendering logic creates numerous opportunities for memory corruption and logic errors.
Critical Vulnerabilities
• CVE-2026-43660 & CVE-2026-28907: Content Security Policy Bypass – Validation and input validation failures allowing maliciously crafted web content to prevent CSP enforcement
• CVE-2026-28962: Sensitive User Information Disclosure – Improved access restrictions implemented to prevent data leakage through crafted web content
Memory Corruption Vulnerabilities
Multiple use-after-free vulnerabilities were patched through improved memory handling, addressing classic exploitation primitives where code accesses deallocated memory:
• CVE-2026-28847
• CVE-2026-28883
• CVE-2026-28947
• CVE-2026-28946
Denial of Service Vulnerabilities
Additional flaws could cause unexpected Safari crashes or process termination:
• CVE-2026-43658
• CVE-2026-28905
• CVE-2026-28904
• CVE-2026-28955
• CVE-2026-28903
• CVE-2026-28953
• CVE-2026-28902
• CVE-2026-28901
• CVE-2026-28913
Enterprise Impact
These vulnerabilities are particularly concerning for enterprise environments where web-based applications constitute primary attack vectors, and successful exploitation could lead to credential theft, session hijacking, or malware delivery through compromised web content.
CVE-2026-28995: App Intents Sandbox Escape
CVE-2026-28995 represents a critical logic flaw in App Intents that allows malicious applications to break out of their sandbox environment, exclusive to macOS Tahoe 26.5. This vulnerability undermines Apple’s core application security model, which relies on sandboxing to restrict application access to system resources and user data. The sandbox escape was addressed through improved restrictions that properly enforce isolation boundaries between sandboxed applications and the broader system.
From a technical perspective, sandbox escapes are highly valued by attackers because they enable malicious or compromised applications to access resources beyond their authorized scope, including sensitive files, system APIs, and inter-process communication channels. Security researchers Vamshi Paili and Tony Gorez from Reverse Society received credit for discovering this vulnerability, highlighting the value of external security research in identifying subtle logic flaws.
The App Intents framework, introduced to facilitate application integration with system features and Siri, presents a complex attack surface where permission boundaries must be carefully maintained. This vulnerability exemplifies how new functionality designed to improve user experience can inadvertently introduce security risks when isolation mechanisms are not rigorously enforced.
In the context of modern attacks, security expert Adam Boynton from Jamf notes that App Intents sandbox escapes are commonly chained with WebKit vulnerabilities and kernel memory issues to achieve complete system compromise, making this vulnerability a valuable component in multi-stage attack chains.
Additional Critical Components and Memory Safety Issues
Beyond the headline vulnerabilities, the May 2026 update addresses numerous memory safety and security boundary issues across core macOS components. The APFS filesystem received fixes for buffer overflow vulnerabilities including CVE-2026-28959, which could allow applications to cause unexpected system termination through improper bounds checking. PackageKit vulnerabilities, notably CVE-2026-28840, enabled applications to gain root privileges, representing another privilege escalation vector requiring immediate attention. Multiple components including AppleJPEG, Audio, CoreMedia, CoreServices, and CoreSymbolication received patches for memory corruption issues that could lead to denial of service, unexpected application termination, or information disclosure. CVE-2026-28922 in CoreMedia allows applications to access private information through inadequate state management, while CVE-2026-28936 in CoreServices involves maliciously crafted files causing application termination. The Accounts framework vulnerability CVE-2026-28988 permits applications to bypass privacy preferences, undermining user consent mechanisms. Gatekeeper received multiple security enhancements to prevent bypass through malicious disk images or ZIP archives, addressing CVE-2026-28949, CVE-2026-28899, CVE-2026-28850, and CVE-2026-28841. These vulnerabilities collectively demonstrate that comprehensive security requires addressing threats across the entire operating system stack, from low-level kernel code to high-level application frameworks and user interface components.
| Component | CVE ID | Impact | Severity |
|---|---|---|---|
| APFS | CVE-2026-28959 | Buffer overflow leading to unexpected system termination | High |
| PackageKit | CVE-2026-28840 | Privilege escalation to root | Critical |
| CoreMedia | CVE-2026-28922 | Access to private information through inadequate state management | Medium |
| CoreServices | CVE-2026-28936 | Application termination via maliciously crafted files | Medium |
| Accounts | CVE-2026-28988 | Bypass privacy preferences | Medium |
| Gatekeeper | CVE-2026-28949 | Security bypass via malicious disk images | High |
| Gatekeeper | CVE-2026-28899 | Security bypass via malicious ZIP archives | High |
| Gatekeeper | CVE-2026-28850 | Security bypass via malicious disk images | High |
| Gatekeeper | CVE-2026-28841 | Security bypass via malicious archives | High |
| AppleJPEG | Multiple CVEs | Memory corruption leading to denial of service | Medium |
| Audio | Multiple CVEs | Memory corruption issues | Medium |
| CoreSymbolication | Multiple CVEs | Information disclosure | Medium |
