Jonathan Bar Or

An out-of-bounds write issue exists where mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. This occurs due to insufficient bounds checking, which is a process of verifying that a program does not access memory outside the boundaries of a predefined buffer.

A type confusion issue exists due to improper memory handling. This flaw may allow an application to cause a denial-of-service, which is a condition where a system becomes unavailable to its intended users.

A permissions issue existed due to insufficient sandbox restrictions, potentially allowing an application to access sensitive user data.

A website may be able to access sensitive user data when resolving symlinks. This issue was addressed by adding an additional prompt for user consent.

A bug collision issue has been reported, with a similarity to an issue reported to Apple. There is limited information available about this issue.

A security issue was identified where a flaw allows an application to potentially access sensitive user data. Microsoft Threat Intelligence discovered a vulnerability (CVE-2025-31199), dubbed "Sploitlight," that bypasses the Transparency, Consent, and Control (TCC) framework via Spotlight plugins. This bypass allows attackers to access sensitive data, including geolocation and metadata cached by Apple Intelligence. The vulnerability allows attackers to extract sensitive information from caches utilized by Apple Intelligence. The issue was addressed with improved data redaction in the updated versions. There is no information available regarding the number of potentially affected devices or any real-world incidents where this issue was exploited. The vulnerability exploits the privileged access of Spotlight plugins.

Integer overflow may lead to out-of-bounds write.

A heap-based buffer overflow issue exists in the `grub udf read block()` function, potentially allowing for arbitrary code execution.

A issue has been identified in GNU grub2 related to an hfs out-of-bounds write.

The issue is related to the use of a non-constant time algorithm for `grub crypto memcmp`, which allows side-channel attacks. This means that an attacker could potentially exploit the difference in time it takes for the comparison to occur, gaining unauthorized access to sensitive information.

The issue is a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is related to the HFS File System Handler component of the GRUB2 bootloader.

The issue is related to a configuration problem that has been addressed with additional restrictions. It allows an app to modify protected parts of the file system. The vulnerability can be exploited by local attackers with root privileges and user interaction, potentially leading to the installation of malicious kernel drivers, rootkits, or other persistent malware. The vulnerability is related to the Storage Kit component, which is responsible for maintaining disk state, and it can be exploited by loading third-party kernel extensions, bypassing System Integrity Protection (SIP).

A security issue exists in macOS related to deficiencies in access control. Exploitation of this issue may allow an attacker to bypass privacy settings. Microsoft discovered this flaw, dubbed "HM Surf", in Apple’s macOS TCC framework. This bypass could allow unauthorized access to sensitive data such as location, camera, and microphone. The issue was addressed by removing the vulnerable code in macOS Sequoia 15. Microsoft Defender for Endpoint detects exploitation attempts, including anomalous modification of the Preferences file. The vulnerability allows malicious apps to access user data without consent, potentially leading to severe privacy breaches. The flaw involves bypassing the Transparency, Consent, and Control (TCC) technology, specifically for the Safari browser. Attackers can manipulate Safari’s configuration files to gain access to sensitive data without user permission.

The issue is related to a logic problem with improved state management, allowing an app to modify protected parts of the file system. This is due to insecure privilege management in the libxpc library of MacOS operating systems.

The issue is related to security-relevant memory corruption via malformed data in a terminfo database file. This can be triggered by local users when the software is used by a setuid application. The corruption can occur when the software accesses files found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variables. The vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information.

A logic issue was addressed with improved checks, allowing an app to bypass Gatekeeper checks. The Gatekeeper function automatically checks all applications downloaded from the internet for a developer signature approved by Apple, requesting user confirmation before running. The vulnerability, named Achilles, allows specially crafted payloads to exploit a logical problem, setting restrictive access control list (ACL) permissions that prevent web browsers and downloaders from setting the com.apple.quarantine attribute for downloaded ZIP files. This enables malicious applications to be deployed on target devices without being blocked by Gatekeeper.

The issue is related to insufficient access controls in the LaunchServices component of Apple operating systems, allowing an attacker to bypass sandbox restrictions. This could enable the execution of malicious code on the system. The vulnerability was discovered while studying methods for launching and detecting malicious macros in Office documents on macOS. It was found that using Launch Services to run a command with a specific prefix allows escaping the application sandbox in macOS. The estimated number of potentially affected devices is not specified.

The issue is related to an out of bounds write in the Chrome OS Audio Server, which can potentially lead to heap corruption via crafted audio metadata. This could allow a remote attacker to exploit the issue, potentially resulting in a denial of service or the execution of arbitrary code.

The issue is related to an inherited permissions problem, which may allow a malicious application to modify protected parts of the file system. This could potentially compromise the integrity of protected information. A malicious application may exploit this issue to gain unauthorized access and make changes to the file system.

A logic issue was addressed with improved state management, allowing a malicious application to bypass Privacy preferences. This issue may lead to data leakage. A malicious actor may be able to gain access to user data by exploiting this issue, potentially allowing them to listen to the microphone, take screenshots, and gain full access to the device.