EUVD-2026-78052
GHSA-6f5v-qph4-3m38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious app to macOS host
-
ExploitApp invokes flawed authorization path
-
ExecutionState-management bug grants unintended access
-
ImpactRead sensitive user data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a malicious or compromised application already running locally on the target Mac; the description ('An app may be able to access sensitive user data') establishes on-device code execution as the precondition, not remote access. Exploitation is limited to unpatched macOS versions below Golden Gate 27, Sequoia 15.8, or Tahoe 26.7. No specific non-default configuration or user interaction beyond installing/running the offending app is indicated, but the attacker must first get their code onto the system, which meaningfully limits real-world reach despite the network-scored CVSS. |
| Impact | This is a classic case of a network-scored vector that contradicts its own description. The vendor CVSS is 7.5 with AV:N/PR:N/UI:N, but the description states 'An app may be able to access sensitive user data' - that plainly implies a malicious app already running locally on the device, not a remote unauthenticated attacker. VERIFY WITH VENDOR: the AV:N and PR:N metrics are almost certainly wrong for a local-app data-access authorization flaw; a realistic vector is AV:L/PR:L, lowering the base to roughly 5.5. Corroborating signals all point to low real-world urgency: EPSS is 0.19% (9th percentile), there is no CISA KEV listing, and no public POC has been identified. CWE-863 (incorrect authorization) with C:H/I:N/A:N is consistent with an app reading data it should not - a confidentiality-only bug, not code execution. Net assessment: real but not a priority patch-tonight issue; the inflated 7.5 overstates it because the network vector does not match the local-app exploitation model. Treat as a routine confidentiality fix bundled into the macOS update train. |
| Exploit ScenarioDerived | A user installs a malicious or over-permissioned app from outside the App Store (or a benign app is compromised). Due to an authorization state-management flaw, the app bypasses macOS privacy/authorization controls and reads sensitive user data (e.g., protected files or private records) it was never granted access to. No public exploit code has been identified, and exploitation requires the attacker's code to already be executing locally on the Mac. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Improper authorization handling in Apple macOS lets a locally running app reach sensitive user data it should not be permitted to access, because the underlying authorization state is not managed correctly. The flaw affects macOS versions prior to Golden Gate 27, Tahoe 26.7, and Sequoia 15.8, and exploits require a malicious or compromised application to already be executing on the target Mac - the external CVSS score of 7.5 (AV:N) is inconsistent with the vendor description and with our assessed vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, which reflects a local, low-privileged precondition. No public exploit code has been identified at time of analysis and EPSS is 0.19% (9th percentile), though Apple has shipped fixes in the versions named above, so patching is the decisive control.
RemediationAI
Vendor-released patches: macOS Golden Gate 27, macOS Tahoe 26.7, and macOS Sequoia 15.8 - update to the release matching your branch via Software Update or your MDM, using the guidance in Apple's advisories at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. Because exploitation requires a malicious or compromised app already running locally, the most effective interim controls reduce the pool of code that can run: enforce Gatekeeper/notarization and MDM application allowlisting so only vetted, signed apps launch (trade-off: blocks legitimate unsigned internal tooling and may require allowlisting exceptions maintained per-team), remove or quarantine untrusted or user-installed applications and restrict non-admin users from installing software (trade-off: friction for developer and power users who routinely sideload tools), and apply least privilege so users do not run day-to-day work from administrator accounts (trade-off: more frequent credential prompts). These are compensating measures only and do not repair the authorization state-management defect, so upgrading to the fixed macOS versions remains the required fix; there is no separate configuration toggle documented as disabling the vulnerable behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863, Incorrect Authorization, specifically a state-management defect in macOS's authorization checks - the system fails to track or revalidate the authorization context correctly, so an already-running application can pass or bypass a check it should fail. Apple's advisory language ('An authorization issue was addressed with improved state management') points to a logic/state-tracking bug rather than memory corruption, which is consistent with the confidentiality-only impact (C:H/I:N/A:N) in both the published and assessed vectors. The affected CPE is the broad wildcard cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*, and EUVD enumerates affected builds as macOS <27, macOS <26.7, and macOS <15.8, i.e. every supported branch prior to the fixed Golden Gate 27, Tahoe 26.7, and Sequoia 15.8 releases. Note the scoring discrepancy: NVD-style scoring produced CVSS:3.1/AV:N/... (7.5), but the description's precondition of an already-running app and our assessed AV:L/PR:L/UI:N vector indicate the real attack surface is local-code-execution-dependent; the network-scored value likely overstates remote reachability and should be treated as an upper bound rather than a realistic exploitation path.
Know when macOS gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description implies a local app already executing (AV:L, PR:L), abusing an authorization flaw to read sensitive data (C:H) with no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data.
Executive ViewAI
Apple macOS endpoints across the organization are exposed to CVE-2026-65378, an authorization weakness that allows an application already running on a Mac to reach sensitive user data it should not be permitted to see, with the primary risk being unauthorized disclosure of confidential user information on affected devices. Exploitation requires an attacker to already have a malicious or compromised application executing locally, so the practical barrier is meaningfully higher than a remotely reachable flaw, and no public exploit code has been identified at time of analysis. Because Apple has shipped fixed versions, the exposure is fully closable through disciplined patch management of the Mac fleet.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility develope
Out-of-bounds write in Apple's iOS, iPadOS, and macOS file-parsing code lets remote attackers achieve arbitrary code exe
Apple's kernel across all platforms (iOS, macOS, watchOS, visionOS, tvOS) contains a memory corruption vulnerability (CV
The issue was addressed with improved checks. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev)
A logic issue was addressed with improved restrictions. Rated high severity (CVSS 7.8), this vulnerability is no authent
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environmen
A race condition was addressed with additional validation. Rated high severity (CVSS 7.0), this vulnerability is no auth
This issue was addressed with improved checks. Rated critical severity (CVSS 10.0), this vulnerability is remotely explo
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from
Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This i
A vulnerability was found in LibTIFF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no aut
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Rated high severity (CVSS 8.8), this
Exploit-DB