CVE-2026-112521 A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sa...

CriticalCVSS 9.3 EPSS 0.22%

Published: 2026-10-26 22:38
Updated: 2026-11-05 15:38
Exploit status: No public exploit known

Description

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions.

Affected products

Product	Affected versions	Fixed in
apple macos	< 15.8.2	15.8.2
apple macos	< 26.7.2	26.7.2
apple macos	< 27.2	27.2
apple macos	>= 15.0, < 15.8.2	15.8.2
apple macos	>= 26.0, < 26.7.2	26.7.2
apple macos	>= 27.0, < 27.2	27.2

References

support.apple.com vendor-advisory
support.apple.com vendor-advisory
support.apple.com vendor-advisory

CVSS v3.1

9.3 Critical

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.22% (percentile 12.2)
CWE: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.