Apple macOS CVE-2026-113947

Exploitation requires the victim to unpack/extract a maliciously crafted archive on macOS (UI:R) - the attacker must first get this archive onto the target and the user must choose to decompress it. No authentication or pre-existing privileges are required (PR:N), and attack complexity is low (AC:L) once the archive is opened. The limiting factor is this mandatory user interaction; there is no indication of an auto-triggering or background-service path. The issue is fully remediated only by updating to macOS 27.2 (Golden Gate); the advisory describes the fix as improved access restrictions and lists no alternative mitigation.

Signals are moderate and largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, score 8.8) describes a high-severity remote, unauthenticated, low-complexity flaw whose only gating factor is required user interaction. Against that, the exploitation signals are low: EPSS is 0.51% (44th percentile), SSVC reports Exploitation: none, Automatable: no (so no evidence of scalable mass exploitation), and there is no CISA KEV listing - meaning no confirmed active exploitation. SSVC Technical Impact: total aligns with the CVSS total-impact rating (arbitrary code execution). The vuln.today Decision label is this_week, i.e. a prioritized-but-not-emergency fix, which is consistent with high technical impact tempered by the user-interaction requirement and absence of in-the-wild exploitation. Net: this is a genuine high-severity issue worth patching promptly, but not an emergency - the UI:R requirement (a victim must unpack a malicious archive) and the lack of exploitation evidence put it below drop-everything priority. One caveat: the CVSS vector is AV:N while the mechanism (unpacking a local archive file) could arguably be local-vector; this does not change the overall priority but is worth noting.

An attacker crafts a malicious archive and delivers it to a macOS user (for example via email, a download, or a messaging app). When the victim extracts the archive, the flaw is triggered, leading to unexpected application termination or arbitrary code execution in the user's context. No public exploit was identified at the time of analysis, and the attack requires the victim to actively unpack the archive (UI:R).