macOS · macOS update · November 9, 2026

Tahoe 26.7.3

Tahoe 26.7.3, released November 9, 2026, fixes 8 CVEs in Tahoe. One of them is being exploited (CVE-2026-111497); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV1 publicly disclosed

CVEs closed

None rated Critical

Exploited

CVE-2026-111497

Highest CVSS

9.8

Base score, 0 to 10

Highest EPSS

0.8264

99th percentile

Priority of the 8 CVEs

Patch now 1
                                Urgent 0
                                High 0
                                Routine 7

Applies to

Product	Version
Tahoe	26.7.3

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
Patch now	CVE-2026-111497	Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder	Processing maliciously crafted input may lead to memory corruption	9.8	0.8264	KEVDisclosedExploited
Routine	CVE-2026-113961	Messages: A remote attacker may be able to join an iMessage group chat and receive its messages	A remote attacker may be able to join an iMessage group chat and receive its messages	n/a	0.0061	None reported
Routine	CVE-2026-113970	Bluetooth: An attacker in Bluetooth range may be able to corrupt process memory	An attacker in Bluetooth range may be able to corrupt process memory	n/a	0.0033	None reported
Routine	CVE-2026-113964	CoreUtils: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction	An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts and pair with a device without user interaction	n/a	0.0032	None reported
Routine	CVE-2026-113968	AirPlay: An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts	An attacker in Bluetooth range may be able to bypass the rate limit on pairing code attempts	n/a	0.0032	None reported
Routine	CVE-2026-113965	CoreUtils: A malicious Bluetooth device may be able to establish a pairing without user interaction	A malicious Bluetooth device may be able to establish a pairing without user interaction	n/a	0.0030	None reported
Routine	CVE-2026-113969	rapportd: An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts	An attacker on the same network may be able to bypass the rate limit on AirPlay pairing code attempts	n/a	0.0022	None reported
Routine	CVE-2026-113960	Messages: A user added to an iMessage group may be able to access messages sent before they joined	A user added to an iMessage group may be able to access messages sent before they joined	n/a	0.0018	None reported

Other Tahoe versions with security fixes

Vendor advisory

https://support.apple.com/en-us/149719

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/macos/tahoe-26.7.3">Tahoe 26.7.3 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Is it current everywhere?

Patchblox finds every install below the fixed version, including per-user copies, and updates them from a signed catalog package.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.