Apple macOS CVE-2026-112457

Exploitation requires the attacker to be on the same local network as the target Mac (CVSS AV:A, 'attacker on the local network'); it is not exploitable from the broader internet without such adjacency. No authentication (PR:N) and no user interaction (UI:N) are needed, and default configurations of affected macOS versions are in scope. The flaw is a double free in memory management, but the specific feature, protocol, or service that must be reachable to trigger it is not described in the available sources. Affected versions are macOS before 15.8.2 (Sequoia), before 26.7.2 (Tahoe), and before 27.2 (Golden Gate); updating to those fixed releases removes exposure. The main limiting factor is the adjacent-network requirement; realistic impact is denial of service (system termination) with limited memory-integrity effect rather than confidentiality loss.

This is a moderate-priority, not emergency, issue and the signals are largely consistent. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 7.1) describes an adjacent-network attack requiring no authentication and no user interaction, with primary impact on availability (unexpected system termination) and limited integrity (memory corruption); confidentiality impact is explicitly none. The exploitation signals temper the raw severity: EPSS is low at 0.35% (29th percentile), the vulnerability is not in CISA KEV, SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and no public exploit was identified in the input. The vuln.today decision label is 'this_week' rather than act_now or emergency, aligning with a patch-promptly posture rather than a fire drill. The key constraint that keeps real-world risk below the 7.1 headline is AV:A - the attacker must already be on the same local network segment, so this is not remotely internet-exploitable. One data note: the 'Information Disclosure' tag conflicts with the CVSS vector (C:N) and the description, which describe a crash/memory-corruption (denial-of-service / integrity) issue, not disclosure - treat the tag as inaccurate.

An attacker positioned on the same local network as a vulnerable Mac sends crafted traffic that triggers a double free (CWE-415) in macOS memory management, causing unexpected system termination or corruption of process memory. No public exploit was identified at time of analysis, and the specific triggering mechanism is not described in the available sources. Exploitation requires adjacent-network access (AV:A), limiting it to attackers who share the victim's local network.