APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2
Apple Product Security via Fulldisclosure ·
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-10-26-2026-4 macOS Golden Gate 27.2 macOS Golden Gate 27.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/149521. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Framework Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86971: an anonymous researcher Accounts Available for: macOS Golden Gate Impact: A malicious application may be able to bypass Privacy preferences Description: A logging issue was addressed with improved data redaction. CVE-2026-113898: Bhaswanth Chigurupati Accounts Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: LiangWei, Sindre Sorhus AirPort Available for: macOS Golden Gate Impact: An app may be able to read sensitive location information Description: An authorization issue was addressed with improved state management. CVE-2026-112551: Nguyen Duc Anh of Noventiq, Sindre Sorhus APFS Available for: macOS Golden Gate Impact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84496: Maher Azzouzi, 준우 이, Jonathan Bar Or (@yo_yo_yo_jbo), Bhuwan Bhetwal, Narendra Singh (@_3P1C), Jakob Pammer, Aswin Kumar Gokula Kannan, Thanatos Tian (HKPolyU) & wgg with Diffract, Marco Schmitt, Kwak kiyong (@Pwnkai23), Song nuri, Nathaniel Oh (@calysteon), an anonymous researcher APFS Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112536: Ruslan Dautov, Kwak Kiyong (@Pwnkai23), Song Nuri, Thanatos Tian (HKPolyU) & wgg with Diffract, Narendra Singh (@_3P1C), Thomas Guillem APFS Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112525: We Muftihaturrahmah, Aswin Kumar Gokula Kannan, Ruslan Dautov, Peter Malone App Store Available for: macOS Golden Gate Impact: An app may be able to bypass network restrictions Description: This issue was addressed with improved checks. CVE-2026-112467: Sindre Sorhus App Store Available for: macOS Golden Gate Impact: A remote attacker may be able to break out of the WebContent sandbox Description: This issue was addressed with improved input validation. CVE-2026-112690: Claudio Bozzato and Francesco Benvenuto of Cisco Talos Apple Neural Engine Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112696: Jaeyeong Lee Apple Neural Engine Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84494: Meta Red Team X - Nik Tsytsarkin AppleAVD Available for: macOS Golden Gate Impact: A malicious app may be able to break out of its sandbox Description: An information leakage was addressed with additional validation. CVE-2026-112704: Josh Maine of Calif.io AppleAVD Available for: macOS Golden Gate Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112416: an anonymous researcher, Dohyeon An @PILAB Technology, Inc, Hcamael and 章鱼哥@aipy (aipyaipy.com), Narendra Singh (@_3P1C), Meta Red Team X - Nik Tsytsarkin AppleAVD Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: An out-of-bounds write was addressed with improved input validation. CVE-2026-112415: Hcamael and 章鱼哥@aipy (aipyaipy.com), Rahul Raj AppleAVD Available for: macOS Golden Gate Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112454: @Licht_jb, Hcamael and 章鱼哥@aipy (aipyaipy.com) AppleMobileFileIntegrity Available for: macOS Golden Gate Impact: A malicious app may be able to read or write to protected files Description: A permissions issue was addressed with additional restrictions. CVE-2026-112539: Claudio Bozzato and Francesco Benvenuto of Cisco Talos AppleRAID Available for: macOS Golden Gate Impact: Mounting a malicious disk image may cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112544: Peter Malone AppleRAID Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-112531: Chanwit Muenprakoddee (ChemIndy) Archive Utility Available for: macOS Golden Gate Impact: An attacker with root privileges may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-86939: Lance Cain - Senior Security Researcher at SpecterOps Inc. ArchiveService Available for: macOS Golden Gate Impact: An app may bypass Gatekeeper checks Description: A logic issue was addressed with improved state management. CVE-2026-86937: YingMuo (@YingMuo) of DEVCORE Research Team, Paul Montgomery (@nullevent) ArchiveService Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may bypass Gatekeeper checks Description: A logic issue was addressed with improved checks. CVE-2026-112568: an anonymous researcher Audio Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112546: lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx (@r3pwnx), an anonymous researcher, Lily Cohl (@GenericCoding), Nathaniel Oh (@calysteon) Audio Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112675: Lakshay Sharma (MrW0r57), Abodi Dawoud AVEVideoEncoder Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112705: Marco Schmitt, Andrey Chernykh, Josh Maine of Calif.io AVEVideoEncoder Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112689: Franco Belman at Blackwing Intelligence AVEVideoEncoder Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112470: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112469: Hcamael and 章鱼哥@aipy (aipyaipy.com) CVE-2026-112468: Hcamael and 章鱼哥@aipy (aipyaipy.com) AVEVideoEncoder Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-112466: Hcamael and 章鱼哥@aipy (aipyaipy.com) Bluetooth Available for: macOS Golden Gate Impact: An attacker in physical proximity may be able to cause a denial-of-service Description: A null pointer dereference was addressed with improved validation. CVE-2026-112566: Chris Bailey - Short Circuit BOM Available for: macOS Golden Gate Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks Description: The issue was addressed with improved checks. CVE-2026-112672: 준우 이, Pasquale Scola BOM Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112670: Bhaswanth Chigurupati Calendar Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-112678: Neon, Niels Hofmans, Mustafa Calap (@ordinal0, dbg.re) Calendar Available for: macOS Golden Gate Impact: Processing a maliciously crafted calendar invitation may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112619: Ivan Fratric of Google Project Zero Carbon Core Available for: macOS Golden Gate Impact: An app may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-86941: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs CloudKit Available for: macOS Golden Gate Impact: A malicious app may be able to gain root privileges Description: A permissions issue was addressed with additional restrictions. CVE-2026-86896: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ColorSync Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: The issue was addressed with improved checks. CVE-2026-86988: Mateusz Jurczyk of Google Project Zero, Meta Red Team X - - Nik Tsytsarkin ColorSync Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may disclose process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112429: Mateusz Jurczyk of Google Project Zero Compression Available for: macOS Golden Gate Impact: An app may be able to disclose kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-113910: Tucker Willenborg configd Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-112545: Frederick Kaludis (Coiffeur0x90), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs Control Center Available for: macOS Golden Gate Impact: A malicious application may be able to bypass Privacy preferences Description: A permissions issue was addressed with additional restrictions. CVE-2026-112462: DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, an anonymous researcher, Zwei Tasse Kaffee, Lakshay Sharma (MrW0r57) Core Image Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-112471: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: macOS Golden Gate Impact: Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds access issue was addressed with improved bounds checking. CVE-2026-113912: an anonymous researcher, 章鱼哥@aipy (aipyaipy.com), Roman Zabicki, Anna Groza (@pwnlambda) of Calif.io CoreAudio Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-113907: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: A race condition was addressed with improved locking. CVE-2026-112708: Nathaniel Oh (@calysteon) CoreAudio Available for: macOS Golden Gate Impact: Processing a maliciously crafted audio file may lead to memory corruption Description: A buffer overflow was addressed with improved size validation. CVE-2026-86972: an anonymous researcher, Meta Product Security CoreAudio Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write was addressed with improved input validation. CVE-2026-86969: Meta Red Team X - Nik Tsytsarkin CoreAudio Available for: macOS Golden Gate Impact: An attacker in radio range may be able to cause unexpected system termination Description: A heap buffer overflow was addressed with improved bounds checking. CVE-2026-112638: Përparim Mjeku, Altin Gashi, Altin Gashi CoreGraphics Available for: macOS Golden Gate Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113950: Substrate, Stefan Esser (Calif) CoreMedia Available for: macOS Golden Gate Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: The issue was addressed with improved memory handling. CVE-2026-86992: Niels Hofmans CoreMedia Available for: macOS Golden Gate Impact: Parsing a file may lead to an unexpected app termination or arbitrary code execution Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-112688: 정우 하 (@0xfa11babe), Chris Bailey - Short Circuit CoreMedia Available for: macOS Golden Gate Impact: A malicious app may be able to access the camera without user permission Description: An access issue was addressed with improved access restrictions. CVE-2026-86990: Mustafa Calap (@ordinal0, dbg.re) CoreStorage Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113946: Nathaniel Oh (@calysteon), Jakob Pammer, Peter Malone CoreStorage Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-113945: Peter Malone CVE-2026-113940: Jay K Patel and Jay J Patel, Narendra Singh (@_3P1C) CVE-2026-113938: 준우 이 CVE-2026-113937: Jay Patel CVE-2026-113936: Jay K Patel and Jay J Patel CVE-2026-113935: Narendra Singh (@_3P1C) CoreStorage Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-113944: Peter Malone CVE-2026-113942: Peter Malone CVE-2026-113941: Nathaniel Oh (@calysteon) CoreStorage Available for: macOS Golden Gate Impact: Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-113943: Peter Malone CVE-2026-113939: Narendra Singh (@_3P1C) CoreStorage Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-113934: Thanatos Tian (HKPolyU) & wgg with Diffract CoreSymbolication Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112604: Nathaniel Oh (@calysteon) CoreText Available for: macOS Golden Gate Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112656: Nurihan Kim (HanTul) working with TrendAI Zero Day Initiative Crash Reporter Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-113900: Frederick Kaludis (Coiffeur0x90), YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Lakshay Sharma (MrW0r57)/WorstCase Labs., Ashish Kavishwar, Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman) CUPS Available for: macOS Golden Gate Impact: A local attacker may be able to elevate their privileges Description: A logic issue was addressed with improved checks. CVE-2026-65327: Sanny Mitra CVMS Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A logic issue was addressed with improved checks. CVE-2026-112530: Alfredo Pesoli (@__rev) of Bynar.io, Claudio Bozzato and Francesco Benvenuto of Cisco Talos DesktopServices Available for: macOS Golden Gate Impact: An app may be able to bypass Gatekeeper checks Description: This issue was addressed with improved checks. CVE-2026-112444: Paul Montgomery (@nullevent) DesktopServices Available for: macOS Golden Gate Impact: An app may bypass Gatekeeper checks Description: A logic issue was addressed with improved checks. CVE-2026-112428: Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc., Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs Directory Utility Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A path handling issue was addressed with improved validation. CVE-2026-112483: Csaba Fitzl (@theevilbit) of Iru, Lyutoon Disk Images Available for: macOS Golden Gate Impact: An app may be able to cause a denial-of-service Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-112502: Narendra Singh (@_3P1C) DiskArbitration Available for: macOS Golden Gate Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-112570: Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda dyld Available for: macOS Golden Gate Impact: An app may be able to bypass sandbox restrictions Description: This issue was addressed with improved access restrictions. CVE-2026-112534: an anonymous researcher FileProvider Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113896: R4mbb, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova FontParser Available for: macOS Golden Gate Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2026-86970: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: macOS Golden Gate Impact: Processing a maliciously crafted font may lead to unexpected app termination or corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112683: Hcamael and 章鱼哥@aipy (aipyaipy.com) FontParser Available for: macOS Golden Gate Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112642: Meta Red Team X - Nik Tsytsarkin FontParser Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A logging issue was addressed with improved data redaction. CVE-2026-112432: D4rthL GPUTools Available for: macOS Golden Gate Impact: Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution Description: This issue was addressed with improved access restrictions. CVE-2026-113947: Narendra Singh (@_3P1C) Heimdal Available for: macOS Golden Gate Impact: An attacker in a privileged network position may be able to impersonate a Kerberos KDC Description: An issue with signature validation was addressed with improved checks. CVE-2026-112518: Roman Zabicki, Tristan Madani (@TristanInSec) from Talence Security Heimdal Available for: macOS Golden Gate Impact: A remote attacker may be able to cause a denial-of-service Description: The issue was addressed with improved memory handling. CVE-2026-86943: Christian Niel Angel of Protectiv IT Security Inc. Heimdal Available for: macOS Golden Gate Impact: A remote attacker may cause an unexpected process termination Description: A double free issue was addressed with improved memory management. CVE-2026-112410: Piotr Jerzy Duszynski Help Viewer Available for: macOS Golden Gate Impact: An app may be able to access user-sensitive data Description: This issue was addressed with improved handling of symlinks. CVE-2026-112523: powerprove, Wojciech Regula of SecuRing (wojciechregula.blog), Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph), R4mbb, Lyutoon, Michael Benich, Seung Je Seong, Niels Hofmans HFS Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112424: Peter Malone HFS Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112475: Aswin Kumar Gokulakannan, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Marco Schmitt HFS Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112456: Jihwan Yoon, Yash Pandya, Parth Raval HomeKit Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-86978: Garin R HomeKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted video file may lead to unexpected system termination Description: An integer overflow was addressed with improved bounds checking. CVE-2026-112596: Garin R iCloud Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-112647: Sattyam Yadav, onetwo, Robert Tran, Merrick Hare, Christian Niel Angel of Protectiv IT Security Inc. (protectiv.ph) iCloud Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An information disclosure issue was addressed with improved logic. CVE-2026-112617: @pixiepointsec ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2026-112571: sh3rlock (김보겸) ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112561: Meta Red Team X - Nik Tsytsarkin CVE-2026-112627: Mateusz Jurczyk of Google Project Zero ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may corrupt process memory Description: A buffer overflow issue was addressed with improved memory handling. CVE-2026-112488: Mateusz Jurczyk of Google Project Zero, Nik Tsytsarkin, an anonymous researcher ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112634: Mateusz Jurczyk of Google Project Zero CVE-2026-112629: Mateusz Jurczyk of Google Project Zero ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112633: Mateusz Jurczyk of Google Project Zero CVE-2026-112614: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj, Piotr Jerzy Duszynski, Mateusz Jurczyk of Google Project Zero ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in disclosure of process memory Description: An uninitialized memory issue was addressed with improved memory handling. CVE-2026-112632: Mateusz Jurczyk of Google Project Zero CVE-2026-112630: Mateusz Jurczyk of Google Project Zero ImageIO Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in memory corruption Description: An integer underflow was addressed with improved input validation. CVE-2026-112625: Mateusz Jurczyk of Google Project Zero IOGPUFamily Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112533: Sihyun Roh (Compsec, SNU), Andrey Chernykh IOHIDFamily Available for: macOS Golden Gate Impact: An attacker may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112515: Charles Stevenson, Seung Je Seong, Mathis Mansière IOKit Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read issue was addressed by removing the vulnerable code. CVE-2026-112478: Nord0x, Marco Schmitt, an anonymous researcher, Narendra Singh (@_3P1C) IOMobileFrameBuffer Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved state handling. CVE-2026-112459: Lily Cohl (@GenericCoding), an anonymous researcher IOStorageFamily Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112554: Bhuwan Bhetwal, Kwak Kiyong (@Pwnkai23), Song Nuri, Nicolas Seriot, Tommy DeVoss from Braze Security Team (@thedawgyg), Tucker Willenborg, Navapon Premkasem, Aswin Kumar Gokulakannan, Peter Malone, Richard Zana IOSurface Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A race condition was addressed with improved locking. CVE-2026-112477: an anonymous researcher Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected changes to copy-on-write memory Description: A memory integrity issue was addressed with improved handling of copy-on-write pages. CVE-2026-112576: Pedro Pinho Kernel Available for: macOS Golden Gate Impact: A malicious app may be able to break out of its sandbox Description: A race condition was addressed with additional validation. CVE-2026-112543: f0r of MurphySec Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112606: Wang Yu Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-65350: Nebula Security (@nebusecurity), Tim Michaud (@TimGMichaud) of Aginor.ai, Xinru Chi of Pangu Lab CVE-2026-112679: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-112532: Peter Malone Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-112517: Pasquale Scola, Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, an anonymous researcher Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112516: greenbynox, an anonymous researcher Kernel Available for: macOS Golden Gate Impact: An attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112514: Marc Newlin of SkySafe, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., greenbynox Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or write kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-84495: Wang Yu CVE-2026-112474: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved memory handling. CVE-2026-112698: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., OpenAI Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-112501: Cem Onat Karagun Kernel Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112476: Arnold Cartagena, Matt Suiche (@msuiche) of Tolmo Kernel Available for: macOS Golden Gate Impact: An app may be able to determine kernel memory layout Description: An information disclosure issue was addressed with improved state management. CVE-2026-112665: Will Estes Kernel Available for: macOS Golden Gate Impact: An app may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112624: Jerry L. Knot Kernel Available for: macOS Golden Gate Impact: An unprivileged attacker may be able to execute arbitrary code as root Description: A logic issue was addressed with improved state management. CVE-2026-112438: Jakob Pammer LaunchServices Available for: macOS Golden Gate Impact: An app may bypass Gatekeeper checks Description: A file quarantine bypass was addressed with additional checks. CVE-2026-112494: Yiğit Can YILMAZ (@yilmazcanyigit) libarchive Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112522: Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran libcryptex Available for: macOS Golden Gate Impact: A malicious app may be able to create files in protected directories Description: This issue was addressed with improved checks. CVE-2026-86945: Andrey Chernykh, an anonymous researcher libxpc Available for: macOS Golden Gate Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved permissions checking. CVE-2026-112497: Claudio Bozzato and Francesco Benvenuto of Cisco Talos LinkPresentation Available for: macOS Golden Gate Impact: Processing a maliciously crafted image may result in memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112621: Vinay Kumar Rasala (Xplo8E) from Appknox, an anonymous researcher Mail Available for: macOS Golden Gate Impact: The user's original email address may be leaked when using the Hide My Email feature Description: A logic issue was addressed with improved restrictions. CVE-2026-112500 Mail Available for: macOS Golden Gate Impact: A remote attacker may be able to cause a denial-of-service Description: A resource exhaustion issue was addressed with improved input validation. CVE-2026-112671: Nathaniel Oh (@calysteon) Mail Available for: macOS Golden Gate Impact: Processing a maliciously crafted message may lead to a denial-of-service Description: A stack overflow was addressed with improved input validation. CVE-2026-112414: Daniel Rodríguez, Nathaniel Oh (@calysteon) mDNSResponder Available for: macOS Golden Gate Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112607: Pasquale Scola MediaAnalysis Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A race condition was addressed with additional validation. CVE-2026-113915: Abodi Dawoud, Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Zhongquan Li (@Guluisacat), Ilya Andr (andrd3v) of Positive Technologies Messages Available for: macOS Golden Gate Impact: A remote attacker may be able to cause unexpected app termination Description: An input validation issue was addressed with improved input validation. CVE-2026-112682: Mahmoud Abdelmoniem Model I/O Available for: macOS Golden Gate Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: An integer overflow was addressed with improved input validation. CVE-2026-112565: Musaab Khan (@bxff), Saoud Khalifah, stratan (@5tratan), Hcamael and 章鱼哥@aipy (aipyaipy.com), Niels Hofmans CVE-2026-112449: ret2happy (@ret2happy) Model I/O Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112563: stratan (@5tratan) CVE-2026-112553: stratan (@5tratan) Model I/O Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112413: Nathaniel Oh (@calysteon) Model I/O Available for: macOS Golden Gate Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: The issue was addressed with improved memory handling. CVE-2026-112485: Nik Tsytsarkin Model I/O Available for: macOS Golden Gate Impact: Processing a maliciously crafted 3D model may lead to memory corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112461: 진규정 (Gyujeong Jin, @G1uN4sh), Lucas Parnell, ret2happy (@ret2happy), Meta Red Team X - Nik Tsytsarkin, YingMuo (@YingMuo) of DEVCORE Research Team, Nathaniel Oh (@calysteon) Model I/O Available for: macOS Golden Gate Impact: Processing a 3D model may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112486: Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Musaab Khan (@bxff) ncurses Available for: macOS Golden Gate Impact: An app may be able to cause a denial-of-service Description: A type confusion issue was addressed with improved memory handling. CVE-2026-112550: Jonathan Bar Or (@yo_yo_yo_jbo) PackageKit Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-112421: Csaba Fitzl (@theevilbit) of Iru and Gergely Kalman (@gergely_kalman) PackageKit Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A permissions issue was addressed with additional restrictions. CVE-2026-113948: Aidan Hunt (forgechroma.com) PackageKit Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with additional validation. CVE-2026-112442: Mickey Jin (@patch1t) Photos Storage Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-65397: Varik Matevosyan (@D4RK7ET), an anonymous researcher Photos Storage Available for: macOS Golden Gate Impact: An app may be able to access a user's Photos Library Description: This issue was addressed with additional entitlement checks. CVE-2026-112676: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova Photos Storage Available for: macOS Golden Gate Impact: An app may be able to bypass certain Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-112660: Prafull Dhiman, Alto_00000 ppp Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: The issue was addressed with improved checks. CVE-2026-113899: Siddharth Aeri ppp Available for: macOS Golden Gate Impact: A malicious app may be able to intercept network traffic Description: A permissions issue was addressed with additional restrictions. CVE-2026-112542: Gabriel '0xv1n' Cardona, Mrunal Chawda, Tristan Madani (Talence Security), Kujtim Kryeziu (Sentry) Printing Available for: macOS Golden Gate Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-112562: 도현 김, YEONGJAE SHIN, Ithrael, an anonymous researcher Printing Available for: macOS Golden Gate Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved validation of symlinks. CVE-2026-112513: OSORI, wdszzml and Atuin Automated Vulnerability Discovery Engine, Csaba Fitzl (@theevilbit) of Iru quarantine Available for: macOS Golden Gate Impact: An app may be able to break out of its sandbox Description: An access issue was addressed with additional sandbox restrictions. CVE-2026-112569: Csaba Fitzl (@theevilbit) of Iru, an anonymous researcher CVE-2026-112498: an anonymous researcher Quick Look Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-86925: JeongAhn Jang, Alto_00000, Nicolas Seriot, 김도현, Abodi Dawoud, Drin Raci of sentry.security, Jakob Pammer, Stuart Wallace, hamayanhamayan, Vinay Kumar Rasala (Xplo8E) from Appknox, Daniel Rodríguez, Ilya Andr (andrd3v), Rahul Raj, Mustafa Calap (@ordinal0, dbg.re) RealityKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112491: Hongsik Kim (mnur) Remote Management Available for: macOS Golden Gate Impact: A user with screen sharing access may be able to view another user's screen Description: A permissions issue was addressed with additional restrictions. CVE-2026-112480: ruitong (@abstract), Andrey Chernykh Remote Management Available for: macOS Golden Gate Impact: An attacker on the local network may be able to cause unexpected system termination or corrupt process memory Description: A double free issue was addressed with improved memory management. CVE-2026-112457: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Nathaniel Oh (@calysteon) Remote Management Available for: macOS Golden Gate Impact: A remote attacker may be able to cause arbitrary code execution Description: An authentication issue was addressed with improved state management. CVE-2026-112427: 준우 이, an anonymous researcher, Ruitong (Abstract Lab, University of Colorado Boulder; lab led by Yueqi Chen) RemoteManagement Available for: macOS Golden Gate Impact: An application may be able to execute arbitrary code with system privileges Description: An authorization issue was addressed with improved access control. CVE-2026-112677: an anonymous researcher, 도현 김, Junyeong Lee (jylab.github.io), Niels Hofmans, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Jonghoon Han (Aegis) SceneKit Available for: macOS Golden Gate Impact: Processing a 3D model may result in disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112425: stratan (@5tratan) SceneKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112423: Rahul Raj SceneKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-112540: f4&Zhiniang Peng with HUST, Geonha Lee (@leegn4a), Kwak Kiyong (@Pwnkai23), Song Nuri, Wout van der Ploeg (woutvanderploeg.nl), Substrate, Piotr Jerzy Duszynski, Tristan Madani (Talence Security), Arni Hardarson (Neonix Security), an anonymous researcher SceneKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to heap corruption Description: An out-of-bounds write issue was addressed with improved input validation. CVE-2026-112464: 정우 하 (@0xfa11babe), Narendra Singh (@_3P1C) SceneKit Available for: macOS Golden Gate Impact: Processing a maliciously crafted file may lead to unexpected process termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-86991: Cem Onat Karagun, YUJUNG CHOI (@Dusker), Mathis Mansière, Rahul Raj Screen Sharing Available for: macOS Golden Gate Impact: Connecting to a malicious VNC server may cause a denial-of-service Description: An integer overflow was addressed with improved input validation. CVE-2026-112519: Piotr Jerzy Duszynski, Nathaniel Oh (@calysteon) Screen Sharing Server Available for: macOS Golden Gate Impact: A remote attacker may be able to cause unexpected app termination or heap corruption Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84590: koocolb, Tristan Madani (Talence Security), Nathaniel Oh (@calysteon), Narendra Singh (@_3P1C) Screen Sharing Server Available for: macOS Golden Gate Impact: A malicious Screen Sharing peer may be able to create arbitrary symlinks as root Description: A path handling issue was addressed with improved logic. CVE-2026-112511: Nathaniel Oh (@calysteon) Screen Sharing Server Available for: macOS Golden Gate Impact: A remote attacker may cause an unexpected process termination Description: An out-of-bounds read issue was addressed with improved input validation. CVE-2026-65384: Nathaniel Oh (@calysteon) Screen Sharing Server Available for: macOS Golden Gate Impact: A malicious application may be able to execute arbitrary code with system privileges Description: This issue was addressed with improved file handling. CVE-2026-112484: Mahmoud Abdelmoniem Screen Sharing Server Available for: macOS Golden Gate Impact: An attacker on the local network may be able to corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112482: Nathaniel Oh (@calysteon) Screen Sharing Server Available for: macOS Golden Gate Impact: An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac Description: An authorization issue was addressed with improved state management. CVE-2026-112473: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) Screen Sharing Server Available for: macOS Golden Gate Impact: An attacker on the local network may be able to cause unexpected process termination or disclose process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112481: Nathaniel Oh (@calysteon) Screen Time Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved access control. CVE-2026-112616: Drin Raci of sentry.security, Chris Bailey - Short Circuit, Mustafa Calap (@ordinal0, dbg.re), Robert Mindo, N.M.Praveen Nawarathne (@zblockrat), Ilya Andr (andrd3v), Sindre Sorhus Security Available for: macOS Golden Gate Impact: Processing web content may disclose sensitive information Description: An input validation issue was addressed with improved input validation. CVE-2026-113913: Niels Hofmans, Stav Nir and Vladimir Tokarev Security Available for: macOS Golden Gate Impact: A sandboxed process may be able to circumvent sandbox restrictions Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-112521: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Richard Hyunho Im (@richeeta) at Route Zero Security Security Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with improved validation. CVE-2026-112506: Robert Tran Security Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A logic issue was addressed with improved checks. CVE-2026-112668: cnitlrt (@abstract), Roman Belovitskiy, Lyutoon, Art Pllana, Redon Gashi of Sentry, ruitong (@abstract), Surej Sekhar, Franco Belman at Blackwing Intelligence, Teodor Sorescu (@teodorsorescu), Eddy Tsalolikhin, lokerxx, Phillip Groves, Sihyun Roh (Compsec, SNU) CVE-2026-112437: lokerxx CVE-2026-86936: cnitlrt (@abstract), lokerxx CVE-2026-112434: ruitong (@abstract), lokerxx Security Available for: macOS Golden Gate Impact: An malicious app may be able to bypass certificate validation Description: A logic issue was addressed with improved state management. CVE-2026-112652: Aditya Kumar Security Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: An authentication issue was addressed with improved validation of user attributes. CVE-2026-112430: ruitong (@abstract) SecurityAgent Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A downgrade issue was addressed with additional version checks. CVE-2026-112493: Mickey Jin (@patch1t) Shortcuts Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112559: Lucas Lammer, Stuart Wallace CVE-2026-112455: Chris Bailey - Short Circuit, Rahul Raj Siri Available for: macOS Golden Gate Impact: An app may be able to access information about a user's contacts Description: A file access issue existed with certain home folder files. This was addressed with improved access restrictions. CVE-2026-86984: Albin Haliti Siri Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-112685: silo, Abodi Dawoud Siri Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved input validation. CVE-2026-112658: Mickey Jin (@patch1t) SMB Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-86946: Jakob Pammer SMB Available for: macOS Golden Gate Impact: An attacker with control of a network file server may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112552: Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Bhuwan Bhetwal, Feng Xue and XGPT of ThreatBook smbx Available for: macOS Golden Gate Impact: A remote attacker may be able to cause unexpected app termination Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-112526: Nathaniel Oh (@calysteon), an anonymous researcher, Narendra Singh (@_3P1C), Tristan Madani (@TristanInSec) from Talence Security smbx Available for: macOS Golden Gate Impact: A remote attacker may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112510: Efstratios Kaplanellis (@5tratan) of Almamater Technologies, Andrey Chernykh smbx Available for: macOS Golden Gate Impact: A remote attacker may be able to cause a denial-of-service or disclose process memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112451: Nathaniel Oh (@calysteon) smbx Available for: macOS Golden Gate Impact: A malicious Screen Sharing peer may be able to corrupt process memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-112505: an anonymous researcher, Narendra Singh (@_3P1C), Andrey Chernykh SoftRAID Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112495: Lyutoon Spotlight Available for: macOS Golden Gate Impact: An app may be able to gain elevated privileges Description: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. CVE-2022-26704: Joshua Mason of Mandiant, Gergely Kalman (@gergely_kalman) Spotlight Available for: macOS Golden Gate Impact: A malicious application may be able to bypass Privacy preferences Description: This issue was addressed with improved checks. CVE-2026-112567: zenith Spotlight Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with additional sandbox restrictions. CVE-2026-112558: D4rthL Spotlight Available for: macOS Golden Gate Impact: A malicious application may be able to bypass Privacy preferences Description: The issue was addressed with improved checks. CVE-2026-112557: D4rthL Spotlight Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed by removing the vulnerable code. CVE-2026-112441: Pan ZhenPeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. Spotlight Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data access restriction. CVE-2026-112628: Santiago Albertengo, Chris Bailey - Short Circuit Storage Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A path handling issue was addressed with improved validation. CVE-2026-112487: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Junyeong Lee (jylab.github.io), Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs, Jaeyeong Lee, Gergely Kalman (@gergely_kalman), Lyutoon StorageKit Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A use after free issue was addressed with improved memory management. CVE-2026-112548: Surej Sekhar StorageKit Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-112541: Maher Azzouzi, Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs (nosebeard.co), Sindre Sorhus, Paul Montgomery (@nullevent), Mickey Jin (@patch1t), Frederick Kaludis (Coiffeur0x90) StorageKit Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved handling of symbolic links. CVE-2026-112535: Sindre Sorhus StorageKit Available for: macOS Golden Gate Impact: An app may be able to modify protected parts of the file system Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-112504: Mickey Jin (@patch1t) StorageKit Available for: macOS Golden Gate Impact: An app may be able to gain root privileges Description: A race condition was addressed with additional validation. CVE-2026-112492: Alfredo Pesoli (@__rev) via Bynario Atlas (bynar.io) System Preferences Available for: macOS Golden Gate Impact: A malicious app may be able to access restricted system interfaces or launder launch attribution Description: An access issue was addressed with improved access control. CVE-2026-86968: Sindre Sorhus System Settings Available for: macOS Golden Gate Impact: An attacker may tamper with code-signed applications to execute arbitrary code in the application's context Description: A race condition was addressed with additional validation. CVE-2026-112556: Paul Montgomery (@nullevent), Mickey Jin (@patch1t) System Settings Available for: macOS Golden Gate Impact: An app may be able to bypass Gatekeeper checks Description: A path handling issue was addressed with improved validation. CVE-2026-112512: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Mufeed VH of Winfunc Research (winfunc.com), Mathis Mansière System Settings Available for: macOS Golden Gate Impact: An app may be able to break out of its sandbox Description: A path handling issue was addressed with improved validation. CVE-2026-112453: Sindre Sorhus TCC Available for: macOS Golden Gate Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed by moving sensitive data. CVE-2026-112577: Ryan Dowd (@_rdowd) Thread Available for: macOS Golden Gate Impact: An attacker in physical proximity may be able to craft malicious network traffic to gain access to a Thread network Description: This issue was addressed with improved authentication. CVE-2026-112595: Wesley Wineberg Time Machine Available for: macOS Golden Gate Impact: An app may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-112447: 云开 江, Joshua Maina, Ithrael, Mahmoud Gamal (@Zombiehelp54) udf Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112529: Nathaniel Oh (@calysteon) udf Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use-after-free issue was addressed with improved memory management. CVE-2026-112524: Tim Michaud (@TimGMichaud) of Aginor.ai, Thanatos Tian (HKPolyU) & wgg & 2st with Diffract, Peter Malone udf Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112508: Aditya Kumar, Aswin Kumar Gokula Kannan, David Krehwinkel USB Available for: macOS Golden Gate Impact: A malicious USB device may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112479: Rotce, Sandeep Wawdane (thecybersandeep), Marc Newlin of SkySafe, Ankur Saini of Volexity, Kwak Kiyong (@Pwnkai23), Song nuri WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328114 CVE-2026-113904: Lily Cohl (@GenericCoding), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis (@lukefr09), Shubham Chaskar, Kwak Kiyong, Song Nuri WebKit Bugzilla: 317465 CVE-2026-112599: Avinash Kumar Thapa & Jay Kaushik Patel WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved checks. WebKit Bugzilla: 321609 CVE-2026-86974: Hossein Lotfi (@hosselot) of TrendAI Zero Day Initiative WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 318331 CVE-2026-86986: an anonymous researcher WebKit Bugzilla: 328131 CVE-2026-112693: 은태 장 WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed with improved input validation. WebKit Bugzilla: 318522 CVE-2026-86985: Pasquale Scola WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 323130 CVE-2026-112699: an anonymous researcher WebKit Bugzilla: 323148 CVE-2026-112680: Franz Bettag, Kwak Kiyong, Song Nuri WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322916 CVE-2026-112697: OpenAI Codex Security - Amy Burnett, 은태 장 WebKit Bugzilla: 324150 CVE-2026-112655: Euntae Jang WebKit Bugzilla: 322120 CVE-2026-112651: Euntae Jang WebKit Bugzilla: 323265 CVE-2026-112623: pwn2addr, Lily Cohl (@GenericCoding) WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A race condition was addressed with improved locking. WebKit Bugzilla: 323986 CVE-2026-112686: an anonymous researcher WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: This issue was addressed through improved state management. WebKit Bugzilla: 328132 CVE-2026-112684: Gia Bui (@yabeow) from Calif.io WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A type confusion issue was addressed with improved state handling. WebKit Bugzilla: 322033 CVE-2026-112673: Myungyong Lee WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A race condition was addressed with improved state handling. WebKit Bugzilla: 323173 CVE-2026-112669: remanone (@remanone_) WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process termination Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322671 CVE-2026-112695: Josef Korbel (Citadelo), Luke Francis (@lukefr09) WebKit Bugzilla: 321669 CVE-2026-112666: Luke Francis (@lukefr09) WebKit Bugzilla: 321934 CVE-2026-112654: Charles Kern WebKit Bugzilla: 323227 CVE-2026-112653: Malik M. (@m411k_) WebKit Bugzilla: 324735 CVE-2026-112615: Chris Rohlf with Anthropic Research WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. WebKit Bugzilla: 321982 CVE-2026-112659: OpenAI Codex Security - Amy Burnett, Chris Rohlf with Anthropic Research WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to memory corruption Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 324262 CVE-2026-112640: an anonymous researcher WebKit Available for: macOS Golden Gate Impact: A website may be able to use a media format that should be restricted in Lockdown Mode Description: A logic issue was addressed with improved checks. WebKit Bugzilla: 324004 CVE-2026-113952: Drinor Selmanaj (Sentry) WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to memory corruption Description: A type confusion issue was addressed with improved state management. WebKit Bugzilla: 323097 CVE-2026-113949: an anonymous researcher WebKit Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to unexpected memory modification Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 321652 CVE-2026-113903: Eddy Tsalolikhin, OpenAI Codex Security - Amy Burnett, Lily Cohl (@GenericCoding) WebKit Canvas Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323377 CVE-2026-112637: Chris Rohlf with Anthropic Research, 은태 장 WebKit JavaScript Bindings Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 328141 CVE-2026-112626: Euntae Jang, Luke Francis (@lukefr09), Shubham Chaskar, Josef Korbel (Citadelo) WebKit Process Model Available for: macOS Golden Gate Impact: A remote attacker may be able to break out of Web Content sandbox Description: This issue was addressed by removing the vulnerable code. WebKit Bugzilla: 328129 CVE-2026-113897: Luke Francis, Jackson Kuja WebKit Process Model Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 322743 CVE-2026-112639: Luke Francis (@lukefr09) WebRTC Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: A use-after-free issue was addressed with improved memory management. WebKit Bugzilla: 323096 CVE-2026-113901: Kwak Kiyong (@Pwnkai23), Song Nuri WebRTC Available for: macOS Golden Gate Impact: Processing maliciously crafted web content may lead to an unexpected process crash Description: An out-of-bounds read was addressed with improved bounds checking. WebKit Bugzilla: 323079 CVE-2026-86973: Narendra Singh (@_3P1C), an anonymous researcher Wi-Fi Available for: macOS Golden Gate Impact: An attacker in physical proximity may be able to corrupt process memory Description: A memory corruption issue was addressed with improved input validation. CVE-2026-113909: an anonymous researcher Wi-Fi Available for: macOS Golden Gate Impact: An app may be able to read sensitive location information Description: This issue was addressed with improved data protection. CVE-2026-112537: Sindre Sorhus Wi-Fi Available for: macOS Golden Gate Impact: An app may be able to cause unexpected system termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-112443: Nathaniel Oh (@calysteon) Wi-Fi Available for: macOS Golden Gate Impact: An attacker in radio range may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-112622: Nathaniel Oh (@calysteon) Wi-Fi Available for: macOS Golden Gate Impact: An attacker in a privileged network position may be able to cause a denial-of-service Description: A denial-of-service issue was addressed with improved input validation. CVE-2026-112620: Nathaniel Oh (@calysteon) WindowServer Available for: macOS Golden Gate Impact: An app may be able to monitor keystrokes without user permission Description: The issue was addressed with improved handling of secure input state. CVE-2026-112575: Ricardo Prado zsh Available for: macOS Golden Gate Impact: A malicious app may be able to break out of its sandbox Description: A validation issue was addressed with improved input sanitization. CVE-2026-112555: Phillip Groves Additional recognition Apple Neural Engine We would like to acknowledge Vladislav Shevchenko (Positive Technologies) for their assistance. AppleFSCompression We would like to acknowledge Dawar Abbasi (x_x10o9), Tucker Willenborg for their assistance. AppleRAID We would like to acknowledge Ashish Kunwar for their assistance. Archive Utility We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Audio We would like to acknowledge Narendra Singh (@_3P1C), Nathaniel Oh (@calysteon) for their assistance. AVEVideoEncoder We would like to acknowledge Josh Maine of Calif.io, Narendra Singh (@_3P1C) for their assistance. Bluetooth We would like to acknowledge John De Armas, an anonymous researcher for their assistance. CipherML We would like to acknowledge Nils Hanff (@nils1729@chaos.social) of Hasso Plattner Institute for their assistance. Core Location We would like to acknowledge 糖豆爸爸(@晴天组织), 이재영 for their assistance. CoreAudio We would like to acknowledge Meta Product Security for their assistance. CoreCrypto We would like to acknowledge Niels Hofmans for their assistance. CoreStorage We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. curl We would like to acknowledge Muhamad Syaiful for their assistance. Feedback Assistant We would like to acknowledge Abodi Dawoud for their assistance. File Bookmark We would like to acknowledge Niels Hofmans, Souta Sugiyama for their assistance. FileProvider We would like to acknowledge Adriatik Raci, R4mbb for their assistance. Foundation We would like to acknowledge Jaya Surya Kommireddy for their assistance. ImageIO We would like to acknowledge Koh M. Nakagawa (@tsunek0h) of FFRI Security, Inc., Mateusz Jurczyk of Google Project Zero, Meta Product Security, Musaab Khan (@bxff), Piotr Jerzy Duszynski for their assistance. Kernel We would like to acknowledge Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd., Robert Tran, Tristan Madani (@TristanInSec) from Talence Security for their assistance. libarchive We would like to acknowledge Muhammad Abdul Rehman, Owais Lone for their assistance. libc We would like to acknowledge Hcamael and 章鱼哥@aipy (aipyaipy.com) for their assistance. mDNSResponder We would like to acknowledge Aswin Kumar Gokula Kannan, Lucas Lammer, pixillated for their assistance. Music We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Notes We would like to acknowledge Joshua Thomas, Mikita Sakalouski for their assistance. Safari We would like to acknowledge Azza Tegar Naufal Ataullah, Exell Nakano, Zhiyang Zeng (@Wester), satrya wira yudha for their assistance. Screen Sharing We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Security Research We would like to acknowledge Anna Groza (@pwnlambda) of Calif.io for their assistance. Service Workers We would like to acknowledge Meta Red Team X - Nik Tsytsarkin for their assistance. Single Sign-On We would like to acknowledge Johan Wahyudi, Rıza Sabuncu - x.com/rizasabuncu for their assistance. SMB We would like to acknowledge Feng Xue and XGPT of ThreatBook for their assistance. SoftwareUpdate We would like to acknowledge Nathaniel Oh (@calysteon) for their assistance. Storage Driver We would like to acknowledge an anonymous researcher for their assistance. Virtualization We would like to acknowledge Nicolò Altamura for their assistance. WebKit We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos, Stan Shaw, Volodymyr Diachenko, Wael Alolowi, an anonymous researcher for their assistance. WebKit Sandboxing We would like to acknowledge Claudio Bozzato and Francesco Benvenuto of Cisco Talos for their assistance. WindowServer We would like to acknowledge Niels Hofmans for their assistance. xar We would like to acknowledge Meridian Miftari for their assistance. zip We would like to acknowledge Feng Xue and XGPT of ThreatBook for their assistance. macOS Golden Gate 27.2 may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/ All information is also posted on the Apple Security Releases web site: https://support.apple.com/100100. This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmrfvNAACgkQ4Ifiq8DH 7PVtrw/9E/H7M0SZ5YfK5C2QdQj89ekUlVB5FBmOl7CazpX3J3wtM3KqlPRpPsbW K1p+e7R7098wgu5/LCQIKzSGTDja+qusMfLPbDCaI1c9uDDuiOE7lUEnJvd9usbZ DZqJVwHG9fd0a51IxjSg3xDYA8dRsUVqPOVJdNuGlHhtv/rSUmo9LjqKtyxThE2L uCYwCvtx48j7OPxQwJX1AvETNNOd29ol6mkzoU+JORRcdy1aEnFhJTBnLTXoFhuP G0KbCJrZhiao30wZGHjaJ9XJSy4iw4UAEBKf4ONDXer7lNhz0e+vZ7qyaccxqjX7 lKdgf6pL/ZoXfzwVZi2xVu4/NebtupQ/kDr9dqzNKEJWu+Sdn4lTQp63xNbXVhlv 04gM9rPCi9gOT+F97HbHHC58B4emhMjgaJ5Y/N6/I7FmLXLXiIV7r1lUoDs2OOEr j/7uPXgFy1OhWuj2xMwHfmoPikQr3XrDJ5glZ/pX5OQ23k0N4LJkxLsQeFmF2XXs CT9s3vXhQYvKcbcc9plSMyu2XZZDDtMNYwlKaKrs6YQztDjSfRieK6AtSFTqd8y/ Q7Fi94BfSiUm0fgeGHQWXUKsguA5bx3bNQnsTn1JtFbqiIDjylOxOLlHgyHkI4Dv AboKzmw7juI728sP7h3p5784TTlm1B9xRaCzP2O0QvnpgEt/MDI= =ZWPy -----END PGP SIGNATURE----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/