Apple macOS CVE-2026-113939

Exploitation requires the victim to mount a maliciously crafted disk image on a macOS system running a version earlier than macOS 27.2 ('Golden Gate'); the user mount action is the explicit trigger (UI:R in the supplied vector). The attacker must first deliver the crafted image and induce the user to mount it, so this is not remote-unauthenticated-against-default-config exploitation. Limiting factors: required user interaction (mounting), confinement to unpatched macOS versions (fixed in 27.2), and that the confirmed outcome is denial of service / kernel memory corruption (A:H) rather than demonstrated code execution or data disclosure.

This is a moderate-severity, memory-safety defect (CWE-787 out-of-bounds write) in macOS that corrupts kernel memory when a maliciously crafted disk image is mounted; the signals converge on a genuine but non-urgent priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 6.5) scores only availability impact (A:H) with no confidentiality or integrity loss, and requires user interaction. EPSS is low at 0.44% (38th percentile), SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial, the issue is NOT on the CISA KEV list, and no PoC or exploit reference is provided - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency. One tension worth flagging: the CVSS vector encodes AV:N (network), yet the described trigger - a user mounting a disk image - is a local file-handling action, so the real-world delivery is 'attacker supplies a file, user mounts it' rather than direct remote exploitation; verify the attack-vector assumption against Apple's advisory. Also note the vector rates I:N while the description explicitly says kernel memory can be corrupted, which arguably implies at least a limited integrity impact. Bottom line: a real bug worth patching on a routine schedule, not a drop-everything emergency.

An attacker distributes a specially crafted disk image (e.g. a .dmg delivered via download, email, or a shared volume) and relies on the victim to mount it on a vulnerable macOS system. Mounting triggers an out-of-bounds write in the disk-image handling code, causing unexpected system termination (denial of service) or corruption of kernel memory that could, in principle, be developed toward further impact. No public exploit code has been identified at time of analysis, and user interaction (the mount action) is required.