Apple macOS CVE-2026-86940

Exploitation requires the attacker to already be able to run code as a local, low-privileged application on the macOS host (PR:L, AV:L) - there is no remote or network path and no user interaction beyond running the malicious app. The affected versions are all macOS releases prior to Golden Gate 27; systems updated to Golden Gate 27 are not exploitable since the vulnerable code was removed. The limiting factors are substantial: the attacker needs prior execution on the device, the impact is confined to reading kernel memory (no code execution, write, or availability impact), and no privilege escalation is granted directly, making this most useful as a component in a larger exploit chain (e.g., KASLR bypass or sandbox escape) rather than a standalone compromise.

This is a moderate-severity local information disclosure flaw (CWE-200) in Apple macOS, scored CVSS 5.5. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) is internally consistent and points to a low-privilege, locally-running application reading kernel memory with high confidentiality impact but no integrity or availability impact. All exploitation signals converge on LOW real-world urgency: EPSS is 0.14% (3rd percentile), the CVE is not in CISA KEV, and no public exploit code is referenced in the provided data. The local attack vector and prior-code-execution requirement (an app must already be running) sharply limit this to a post-compromise or malicious-app scenario rather than remote mass exploitation. No SSVC decision data was provided. There is no conflict between the signals - low EPSS, no KEV, and the local/authenticated vector all agree this is a genuine but non-urgent patch-in-normal-cycle issue, valuable chiefly as a sandbox-escape or exploit-chain primitive rather than a standalone priority.

A malicious or compromised application already running on a macOS device below version Golden Gate 27 invokes the vulnerable code path to read regions of kernel memory it should not access, leaking sensitive data such as pointers or secrets useful for defeating KASLR or building a larger exploit chain. No public exploit code is identified at time of analysis, and the local attack vector means the attacker must first achieve code execution on the host.