EUVD-2026-104722
GHSA-jh3m-g6w6-xjp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun malicious app on macOS
-
ExploitSupply crafted path to bypass validation
-
ExecutionTraverse to protected data location
-
ImpactRead protected user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-controlled application already running locally on the macOS host with at least low (standard user) privileges (AV:L, PR:L) - i.e., the victim must install or execute a malicious/compromised app; there is no remote or network path. No user interaction beyond running the app is needed (UI:N). The flaw lets that app use improper path handling to reach protected user data; it is limited to confidentiality disclosure (no integrity or availability impact) and is fixed in macOS Golden Gate 27, so patched systems are not exploitable. |
| Impact | This is a moderate-severity local information-disclosure flaw, not an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) describes a locally-exploitable issue that requires an already-present low-privileged app on the system (PR:L) and yields confidentiality impact only (C:H, I:N, A:N) - consistent with a malicious or compromised app bypassing path validation to read protected user data. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no signal of active or imminent widespread exploitation; by the precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent - the description ('An app may be able to access protected user data') aligns with the local vector and confidentiality-only impact - so there is no contradiction to flag. The practical risk is that this is a privilege/sandbox-escape-style data-access bug useful as one link in a larger local attack chain rather than a standalone remote threat; a patch is available (macOS Golden Gate 27), making remediation straightforward and lowering urgency further. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised low-privilege application on macOS. That app exploits improper path validation (CWE-22 path traversal) to escape its intended access boundaries and read protected user data it should not be able to reach. No public exploit code was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
A local path-handling flaw in macOS (addressed in Golden Gate 27) allows an application already running on the host to use improper path validation to reach protected user data, resulting in confidentiality-only impact. Exploitation requires the attacker to have a malicious or compromised app running with standard user privileges and no network path exists, so it is a moderate-severity local information-disclosure issue rather than an urgent priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Apple has released a fix in macOS Golden Gate 27.
RemediationAI
Upgrade to macOS Golden Gate 27, which Apple states fixes this path-handling issue through improved validation (vendor-released patch; see https://support.apple.com/en-us/149035). Because exploitation requires a malicious app already running locally with standard user privileges, the practical interim controls are to avoid installing or running untrusted applications and to enforce Gatekeeper/notarization, managed allow-listing of applications, and removal of local admin rights for day-to-day accounts - trade-offs being reduced user flexibility and additional administrative overhead. Until patched, restrict access to sensitive user data directories via existing TCC/full-disk-access controls and audit which apps hold broad data-access grants, noting that tightening these permissions can break legitimate application functionality. No vendor workaround beyond upgrading is documented in the available references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (improper limitation of a pathname to a restricted directory, i.e. path traversal), but realized in a local, inter-process context on macOS rather than a classic web-facing traversal. macOS sandboxes and per-user data protections rely on path-based checks and container boundaries to decide whether a process may read files such as protected user data; if the operating system component handling those path checks fails to canonicalize or validate a supplied path properly (e.g. traversal sequences, symlinks, or equivalent path aliasing), a local app can escape its intended access boundary and read files it should not. Per the CPE (cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*) and EUVD version range, all macOS versions before 27 (macOS Golden Gate) are affected. The CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms the attack is strictly local, needs only low/standard-user privileges, requires no user interaction beyond running the app, and yields high confidentiality impact with no integrity or availability effect; scope is unchanged, so the impact stays within the macOS security boundary.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local malicious app with standard-user privileges (AV:L, PR:L, UI:N) exploits path validation to read protected data, giving C:H with no integrity or availability impact.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27. An app may be able to access protected user data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB