Apple macOS CVE-2026-84512

Exploitation requires the victim to actively mount a maliciously crafted disk image (e.g., a .dmg) on an affected macOS version below Golden Gate 27 / Sequoia 15.8 / Tahoe 26.7. The key limiting factor is mandatory user interaction (UI:R): the attacker must deliver the image and the user must choose to mount it - there is no autonomous remote trigger against a listening service. No authentication or elevated privileges are needed (PR:N), and no special product configuration is required beyond default macOS disk-image handling.

This is a genuine but not urgent priority. The vendor CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates it High, but the network attack vector is questionable: exploitation requires the victim to obtain AND actively mount a maliciously crafted disk image, which is a local file-parsing operation in the kernel rather than a remotely-reachable service. The AV:N/UI:R combination is Apple's typical scoring for delivered-file bugs, but the real-world constraint is user-driven mounting, so this behaves more like a local (AV:L) UI:R issue - verify vector interpretation before treating as remotely exploitable. Corroborating the lower urgency: EPSS is only 0.21% (12th percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public exploit code identified. The C:H/I:H impacts are the plausible ceiling for kernel memory corruption but the described primary effect is unexpected system termination (A:H / DoS); full confidentiality/integrity compromise would require successful, controlled kernel exploitation, which is non-trivial. Net: patch on normal cadence for a client-OS memory-corruption bug, but no signal of imminent mass exploitation.

An attacker distributes a malicious .dmg disk image (via download, email attachment, or a shared drive) and social-engineers a macOS user into mounting it. When the OS parses the crafted image, a buffer overflow corrupts kernel memory, crashing the system or potentially enabling kernel-level compromise. No public exploit code has been identified, and exploitation depends on the victim taking the mount action (UI:R).