Apple macOS CVE-2026-84547

Exploitation requires the attacker to be in physical proximity to the target Mac (CVSS AV:P), which is the primary limiting factor - this cannot be exploited remotely over a network. No authentication is required (PR:N) and no user interaction is needed (UI:N) once proximity is achieved, and attack complexity is low (AC:L). The flaw affects macOS versions prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; systems patched to these versions are not vulnerable. The vendor describes no special feature or non-default configuration requirement - the triggering condition is delivery of malformed input that the pre-patch input validation fails to reject, causing process memory corruption. Realistic impact is bounded to low confidentiality and integrity with no availability loss.

All available signals converge on this being a genuinely low-priority issue rather than a high-CVSS alarm. The CVSS 3.1 base score is only 3.5, driven primarily by the physical attack vector (AV:P), which is the single strongest mitigating factor - an attacker must be in physical proximity to the target Mac. Although no privileges (PR:N) and no user interaction (UI:N) are required and complexity is low (AC:L), impact is limited to low confidentiality and low integrity (C:L/I:L) with no availability impact (A:N). The multi-source signals reinforce this low priority and do not conflict: EPSS is 0.17% (6th percentile), SSVC from CISA scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial', and the vulnerability is not on the CISA KEV list. There is no public exploit identified at time of analysis. The main caveat is that 'memory corruption' can sometimes be chained or escalated beyond the rated C:L/I:L impact, but nothing in the provided data indicates such escalation, and the physical-proximity requirement sharply limits real-world exploitability. This is a routine, low-urgency patch for most environments.

An attacker with physical proximity to an unpatched Mac (e.g., via a malicious peripheral, local wired/wireless interface, or direct device access in a shared or public setting) sends malformed input that fails validation and corrupts process memory. Given CVSS AV:P/AC:L/PR:N/UI:N, no credentials or user interaction are needed once proximity is achieved, but the physical-presence requirement makes opportunistic or remote exploitation infeasible. No public exploit code has been identified at time of analysis.