Rodolphe BRUNETTI found several vulnerabilities, patched in the latest Apple update :

CVE in MigrationKit

MigrationKit
Available for: macOS Tahoe
Impact: An app may be able to access user-sensitive data
Description: This issue was addressed with improved handling of symlinks.

CVE-2026-20694: Rodolphe Brunetti (@eisw0lf) of Lupus Nova

CVE in Music

Music
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.

CVE-2026-20632: Rodolphe Brunetti (@eisw0lf) of Lupus Nova

Links

• Apple Security Advisory macOS Tahoe 26.4
• Apple Security Advisory macOS Sequoia 15.7.5
• Apple Security Advisory macOS Sonoma 14.8.5
• NIST entry CVE-2026-20694
• NIST entry CVE-2026-20632