Apple macOS Sonoma (14) Update Version macOS Sonoma 14.8.7

macOS Sonoma 14.8.7 addresses multiple security issues across APFS, Kernel, Wi-Fi, and other components. Apple lists numerous CVEs, including CVE-2026-28959, CVE-2026-28915, and CVE-2026-39871.

• APFS: buffer overflow could cause unexpected system termination; improved bounds checking. CVE-2026-28959
• AppleJPEG: memory corruption could lead to app termination or process memory corruption; improved input validation. CVE-2026-28956
• Audio: malicious media could terminate the process; improved memory handling. CVE-2026-39869
• CoreMedia: app could access private information; improved state management. CVE-2026-28922
• CUPS: app could gain root privileges; improved path validation. CVE-2026-28915
• FileProvider: race condition could expose sensitive user data; additional validation. CVE-2026-43659
• GPU Drivers: malicious app could break out of sandbox; improved data redaction. CVE-2026-28923
• HFS: buffer overflow could cause system termination or write kernel memory; improved bounds checking. CVE-2026-28925
• Icons: app could break out of sandbox; additional sandbox restrictions. CVE-2025-43524
• Installer: malicious app could break out of sandbox; additional restrictions. CVE-2026-28978
• IOHIDFamily: memory corruption could cause app termination; improved locking. CVE-2026-28992
• IOHIDFamily: logging issue could reveal kernel memory layout; improved data redaction. CVE-2026-28943
• IOKit: use-after-free could cause system termination; improved memory management. CVE-2026-28969
• Kernel: multiple issues could disclose kernel memory, bypass Gatekeeper, read/write kernel memory, gain root privileges, or modify protected file system areas; improved memory handling, input validation, state management, and additional checks. CVE-2026-43654, CVE-2026-28954, CVE-2026-28897, CVE-2026-28952, CVE-2026-28908, CVE-2026-28951, CVE-2026-28972, CVE-2026-28986
• Mail Drafts: replying to email could display remote images in Mail in Lockdown Mode; improved checks. CVE-2026-28987
• mDNSResponder: local network or remote attackers could cause denial-of-service or kernel memory corruption; improved memory handling and bounds checking. CVE-2026-28929, CVE-2026-43653, CVE-2026-43668
• Networking: attacker could track users through IP address; improved state management. CVE-2026-43666
• PackageKit: app could gain root privileges; additional restrictions. CVE-2026-28906
• Quick Look: malicious file could cause app termination; improved input validation. CVE-2026-28840
• SceneKit: malicious image could corrupt process memory or cause app termination; improved memory handling and bounds checking. CVE-2026-43656, CVE-2026-39870
• Shortcuts: app could access user-sensitive data; added an additional consent prompt. CVE-2026-28846
• Storage: race condition could expose sensitive user data; additional validation. CVE-2026-28993
• StorageKit: app could gain root privileges; improved state handling. CVE-2026-28996
• Sync Services: app could access Contacts without user consent; improved handling of symbolic links. CVE-2026-28919
• TV App: app could observe unprotected user data; improved logic. CVE-2026-28924
• Wi-Fi: out-of-bounds write could allow arbitrary code with kernel privileges; use-after-free could enable denial-of-service from privileged network position. CVE-2026-39871, CVE-2026-28819
• zlib: malicious website could leak sensitive data; additional validation. CVE-2026-28994

• Applies to macOS Sonoma.
• Apple security documents reference vulnerabilities by CVE-ID when possible.

Product Information

Vendor: Apple

Product: macOS

Product type: Software

Platform: macOS

Variant: Sonoma (14)

Version: macOS Sonoma 14.8.7

Vendor information published: May 11, 2026

Original release notes: View on vendor site

Published on updatealert.io: Jun 30, 2026

Description: Desktop operating system for Apple Mac devices.