# NCSC-NL Details Apple macOS Patch Bundle

Published: 2026-10-27 · Severity: routine
Canonical: https://vorant.io/reports/2d097efd-a1c6-5c24-aa61-6957ca73853c/ncsc-nl-details-apple-macos-patch-bundle

> NCSC Netherlands published an advisory on hundreds of Apple macOS vulnerabilities, including a critical 9.8 CVSS flaw, fixed across multiple OS versions.

The Dutch National Cyber Security Centre (NCSC-NL) issued advisory NCSC-2026-0455 covering a large batch of vulnerabilities patched by Apple across macOS Golden Gate 27.2, Sequoia 15.8.2, Tahoe 26.7.2, Monterey 12.4, and related updates to tvOS, visionOS and watchOS. The flaws span memory-safety issues (out-of-bounds read/write, use-after-free, double-free, buffer overflows, type confusion), race conditions, insecure temporary file handling, insufficient symlink validation, and incorrect/incomplete authorization checks. Exploitation could allow local or remote attackers to escalate privileges, bypass sandbox restrictions, access sensitive user data or kernel memory, cause denial-of-service crashes, or bypass Gatekeeper code-integrity and app-verification checks.

Apple also addressed memory corruption issues in parsers for common file formats (images, video, audio, fonts, PDFs, ZIP archives) that could lead to code execution when processing malicious files. Among the hundreds of listed CVEs, several carry high CVSS scores, notably CVE-2026-64767 (9.8) and multiple entries rated 8.1–8.8 affecting privilege escalation and code execution paths. The advisory does not indicate in-the-wild exploitation of any of these flaws; it is a standard coordinated patch release.

Defenders running macOS, tvOS, visionOS or watchOS should prioritize deployment of the referenced updates, particularly on systems exposed to untrusted file input (documents, media, archives) or where sandbox/Gatekeeper enforcement is security-relevant. No specific exploitation reports accompany this bulletin, so patching per normal update cycles is sufficient; however, the presence of a 9.8-rated flaw warrants expedited rollout where feasible.

## Mentioned in this report

- Vulnerabilities: CVE-2022-26704, CVE-2026-112415, CVE-2026-112427, CVE-2026-112438, CVE-2026-112457, CVE-2026-112471, CVE-2026-112484, CVE-2026-112544, CVE-2026-112556, CVE-2026-112614, CVE-2026-112623, CVE-2026-112626, CVE-2026-112629, CVE-2026-112633, CVE-2026-112634, CVE-2026-112637, CVE-2026-112651, CVE-2026-112655, CVE-2026-112659, CVE-2026-112688, CVE-2026-112708, CVE-2026-113907, CVE-2026-113913, CVE-2026-113939, CVE-2026-113943, CVE-2026-113947, CVE-2026-20648, CVE-2026-20649, CVE-2026-28864, CVE-2026-28991, CVE-2026-64750, CVE-2026-64767, CVE-2026-65327, CVE-2026-84496, CVE-2026-86916, CVE-2026-86929, CVE-2026-86971

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0455.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2d097efd-a1c6-5c24-aa61-6957ca73853c/ncsc-nl-details-apple-macos-patch-bundle.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup