EUVD-2026-110415
GHSA-wh8c-j4fq-prpg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privilege local code execution on macOS
-
ExploitLaunch app exercising vulnerable code path
-
ExecutionWin race-condition timing window via concurrent operations
-
ImpactCause system termination or corrupt process memory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already run code via an app on the target macOS system (AV:L, PR:L, UI:N) - there is no remote or network-reachable vector. Because the flaw is a race condition (CWE-362), exploitation depends on winning a timing window, reflected in AC:H and the SSVC 'Automatable: no' rating, so success is non-deterministic rather than guaranteed. Limiting factors: local low-privilege code execution is a prerequisite, the impact is bounded to a single process's memory corruption or an unexpected system termination (availability), and no confidentiality boundary is crossed. Applies to macOS versions below 27.2 (Golden Gate), 15.8.2 (Sequoia), and 26.7.2 (Tahoe). |
| Impact | This is a medium-severity local issue (CVSS 5.3) whose signals are internally consistent and point to low real-world urgency. The CVSS vector requires local access (AV:L), high attack complexity (AC:H, consistent with the CWE-362 race condition that must win a timing window), and existing low privileges (PR:L) - i.e. the attacker must already be able to run code/an app on the target macOS host. Exploitation signals reinforce low priority: EPSS is 0.15% (4th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, there is no CISA KEV listing, and no public exploit was identified. The impact is limited to availability (A:H, system termination) and partial integrity (I:L, process-memory corruption) with no confidentiality impact (C:N). Note a conflict in the input metadata: the 'Information Disclosure' tag contradicts both the CVSS vector (C:N, no confidentiality impact) and the description, which describes a crash/memory-corruption condition rather than data exposure - treat the information-disclosure framing as unverified. The vuln.today 'this_month' decision label aligns with this picture: patch in a normal cycle, not an emergency. |
| Exploit ScenarioDerived | A malicious or compromised application already running on a macOS machine repeatedly exercises the vulnerable code path, attempting to win the race-condition timing window described by CWE-362. On a successful race it corrupts process memory or triggers unexpected system termination (denial of service). No public exploit code has been identified, and the high attack complexity means success is not reliable on any single attempt. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
An app already running on an affected Mac can win a race condition to corrupt process memory or cause unexpected system termination; Apple corrected the locking defect in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. Reachability is local only (CVSS 5.3, AV:L/AC:H/PR:L/UI:N), so an attacker needs existing low-privilege code execution on the host and must then win a timing window, making success non-deterministic and matching the SSVC 'Automatable: no' rating. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.15% (4th percentile), which supports scheduling the update in the current monthly cycle rather than treating it as an emergency.
RemediationAI
Apple fixed CVE-2026-112708 with improved locking in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2, with the three advisory pages at support.apple.com/en-us/149521, /149522, and /149523 corresponding to those releases; update the branch in use to its listed fixed version. The vendor documents no separate workaround for this issue - the advisory describes only the locking change, so there is no feature toggle, entitlement, or configuration setting to disable as a compensating control, and updating is the only complete fix. Where an immediate upgrade is not possible, exposure remains limited to code that is already executing locally on the host, which is consistent with the 'this_month' priority, the EPSS score of 0.15%, and the absence of KEV or public exploit reporting; validate the installed build against the fixed version for each branch rather than relying on the marketing name.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-362 (concurrent execution using a shared resource with improper synchronization) is the root-cause class, and Apple's advisory states the issue was 'addressed with improved locking' - a shared resource was reachable from more than one execution context without adequate serialization, and the correction adds locking rather than removing functionality. Apple does not name the specific subsystem, kernel extension, or service involved, so which shared structure is raced is not described in the available sources. The CPE entry cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* is a wildcard across the macOS product line, while EUVD resolves the affected ranges to macOS below 27.2, below 15.8.2, and below 26.7.2 - one range per supported branch. The assessed vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H describes severity rather than mechanism: it confirms a local attack surface with low privileges and no user interaction, records high attack complexity consistent with a timing window that must be won and with the SSVC 'Automatable: no' rating, and bounds impact to integrity:low plus availability:high with confidentiality:none - the outcome is process memory corruption or system termination, not data disclosure. The 'Information Disclosure' tag present in the source data is not corroborated by the assessed C:N rating and should not be used to describe impact.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Local app access needed (AV:L, PR:L); the race condition requires winning a timing window (AC:H); no data exposure (C:N); partial integrity from memory corruption (I:L) and crash gives A:H.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB