macOS EUVD-2026-110444

Requires local access to the affected macOS system (AV:L); the attacker must already be able to run code on the host. The CVSS vector lists PR:N (no account privileges), but the description characterizes the actor as a 'local attacker' seeking privilege elevation, so the exact required foothold is not described in the available sources and should be confirmed with Apple. No user interaction is required (UI:N). The flaw is addressed as 'a logic issue ... with improved checks' (CWE-693, protection-mechanism failure); the specific feature, configuration, or code path that triggers it is not described in the available sources. Exploitation is limited to systems running macOS versions before the fixed releases (26.7.2, 27.2, 15.8.2) and requires the attacker to first obtain local execution, which constrains it to post-compromise or malicious-local-app scenarios rather than remote attack.

Signals are consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) describes a local privilege-escalation flaw with total impact on confidentiality, integrity and availability, matching the SSVC assessment of Technical Impact: total. However, exploitation requires local access (AV:L), which materially lowers real-world urgency versus a network-reachable bug. The maturity signals all agree it is not yet under attack: SSVC Exploitation is 'none', the CVE is not in CISA KEV, no PoC or exploit reference is supplied, and EPSS is low at 0.24% (15th percentile). The vuln.today Decision label is 'this_week', consistent with a patched, high-impact local flaw that should be remediated promptly but is not an active-exploitation emergency. One point to verify with the vendor: the Apple-provided vector uses PR:N (no privileges required) even though the description frames this as a 'local attacker' elevating privileges - the exact pre-existing foothold the attacker needs is not described in the available sources. Overall this is a legitimately high-severity patch-this-week item rather than a drop-everything event, driven by impact severity rather than any exploitation evidence.

An attacker who already has local, low-privilege access to a Mac (for example a logged-in standard user or code running in a sandbox) abuses a logic/protection-mechanism flaw to gain elevated privileges, after which they have full control over confidentiality, integrity and availability of the system. The precise trigger is not described in the available sources. No public exploit identified at time of analysis, so this would currently require original exploit development.