EUVD-2026-104725
GHSA-254r-9hrv-hg33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to macOS host
-
ExploitUser runs the app locally
-
ExecutionApp abuses excess entitlements
-
ImpactRead user-sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker's code to already be running locally as an application on the macOS host (AV:L) - i.e., a malicious or compromised app must be installed and executed; there is no remote, network-facing vector. The flaw stems from the app being granted additional entitlements it should not have had, which the fix removes, so exploitation is tied to that entitlement misconfiguration in versions before macOS Golden Gate 27. Limiting factors: local code execution is a prerequisite, impact is confined to disclosure of user-sensitive data (no integrity or availability impact), and updating to macOS Golden Gate 27 is the vendor's stated remediation. The specific entitlement, feature, or data category involved is not detailed in the available sources. |
| Impact | This is a moderate-severity local information-disclosure issue in Apple macOS, and the available signals are consistent rather than conflicting. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5) describes a local attack with low complexity, no user interaction, a high confidentiality impact and no integrity or availability impact - a read-only exposure of user-sensitive data, not code execution or system takeover. EPSS is very low (0.14%, 3rd percentile) and the CVE is NOT on CISA KEV, so there is no indication of active or imminent widespread exploitation; no SSVC decision block or POC reference is present in the input. The vendor (Apple) is the reporter, a patch is available, and vuln.today assigns a 'this_month' priority rather than an emergency. Net assessment: a genuine but non-urgent privacy/confidentiality fix - prioritize for routine monthly patching, not emergency response. No SSVC automatable/technical-impact fields were provided, so the decision rests on CVSS plus the low EPSS and absent KEV. |
| Exploit ScenarioDerived | A user installs or is tricked into running a malicious or compromised application on macOS; because of the extra entitlements that were removed in the fix, that app reads user-sensitive data it should not be able to reach. No public exploit or PoC is identified in the provided data, and because AV:L/AC:L the attack is local and low-complexity but requires the attacker's code to already be executing on the machine. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Information disclosure in Apple macOS allows an app already installed and running on the host to reach user-sensitive data it should not be able to read, because the app was granted additional entitlements it should not have held. Apple addressed the flaw by removing those entitlements, and the fix ships in macOS Golden Gate 27; all earlier macOS releases in the tracked range (EUVD: 0 < 27) are affected. The assessed vector is local with no privileges required beyond executing a local app (AV:L/PR:N), confidentiality-only impact, and no integrity or availability effect; there is no remote or network-facing path. No public exploit has been identified at time of analysis, EPSS is 0.14% (3rd percentile), the issue is not in CISA KEV, and the priority signal is this_month - a moderate-severity, locally triggered disclosure rather than an emergency.
RemediationAI
Vendor-released patch: macOS Golden Gate 27. Apple states the issue is fixed in macOS Golden Gate 27 by removing the additional entitlements, so the complete remediation is upgrading affected hosts to that release; details are in the Apple advisory at https://support.apple.com/en-us/149035. The available sources do not document any configuration toggle, entitlement-disable switch, or partial mitigation for hosts that cannot be updated immediately - because the fix is a change to entitlements shipped with the OS, there is no user-facing setting equivalent to the patch. Prioritization is this_month rather than emergency: EPSS is 0.14% (3rd percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, but exploitation does require malicious or compromised code to already be running locally as an app, so restricting installation and execution of untrusted applications remains the practical exposure limiter until the upgrade is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
macOS gates access to sensitive user data and protected resources through the entitlement system: entitlements are declared inside an app's code signature and are validated by the kernel and by platform services, so an app holding an entitlement it does not legitimately need inherits capabilities beyond its intended role. Apple's advisory states the issue was addressed by removing additional entitlements, which ties the root cause to improper privilege management (CWE-269) - an over-broad grant of privileges rather than a memory-safety defect. The CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* and the EUVD range of macOS 0 through 27 confirm this is an operating-system-wide component issue fixed in the macOS Golden Gate 27 release rather than a third-party app defect. The assessed vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) matches the prerequisite that attacker code is already executing locally as an application on the host; the specific entitlement, the feature it protects, and the precise data category disclosed are not described in the available sources, and the trigger beyond the entitlement misconfiguration is likewise not detailed.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local because a malicious app must run on-device (AV:L); no authentication or special privilege beyond executing an app (PR:N); read-only exposure of sensitive data gives C:H, I:N, A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
This issue was addressed by removing additional entitlements. This issue is fixed in macOS Golden Gate 27. An app may be able to access user-sensitive data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB