{"id":"CVE-2026-112457","kind":"vulnerability","aliases":["CVE-2026-112457"],"related":[],"title":"Apple macOS: double free lets a network attacker crash or corrupt memory","description":"A double free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected system termination or corrupt process memory.","summary":"A double free bug in macOS memory handling can be triggered by an attacker on the local network. The sources say it can cause unexpected system termination or corrupt process memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["fixed-macos-build"],"how_to_check":"- Run `sw_vers -productVersion` and compare with the fixed releases listed in the sources.\n- Check Software Update in System Settings for pending macOS updates.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), as named in the advisory text.","status":"open","published_at":"2026-10-26T21:17:35+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","triaged_at":"2026-10-26T21:30:21+00:00","updated_at":"2026-10-26T21:30:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:30:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), as named in the advisory text.","reach":"network","title":"Apple macOS: double free lets a network attacker crash or corrupt memory","impact":"medium","summary":"A double free bug in macOS memory handling can be triggered by an attacker on the local network. The sources say it can cause unexpected system termination or corrupt process memory.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker crashes the system or corrupts process memory over the network","analyst_note":"Check Apple's security release notes for affected components, exploitation details and whether a specific service is required to trigger it.","how_to_check":"- Run `sw_vers -productVersion` and compare with the fixed releases listed in the sources.\n- Check Software Update in System Settings for pending macOS updates.","needs_analyst":true,"not_affected_if":["fixed-macos-build"],"who_is_affected":"Macs running macOS releases older than the fixed versions named in the advisory. The sources say the attack comes from the local network, so machines on untrusted or shared networks are the most exposed. Systems already on the fixed builds can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00058,"input_tokens":3285,"output_tokens":503,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112457':15A,18A '-2026':14A,17A '15.8.2':76C '26.7.2':79C '27.2':73C 'abl':88C 'address':60C 'appl':1A,20B 'apple-devic':19B 'attack':8A,37B,81C 'bug':27B 'caus':47B,90C 'corrupt':11A,52B,95C 'crash':9A 'cve':13A,16A 'devic':21B 'doubl':3A,25B,56C 'fix':68C 'free':4A,26B,57C 'gate':72C 'golden':71C 'handl':31B 'improv':62C 'infrastructur':22B 'issu':58C,66C 'let':5A 'local':40B,84C 'maco':2A,23B,29B,70C,74C,77C 'manag':64C 'may':86C 'memori':12A,30B,54B,63C,97C 'network':7A,41B,85C 'process':53B,96C 'say':44B 'sequoia':75C 'sourc':43B 'system':49B,92C 'taho':78C 'termin':50B,93C 'trigger':34B 'unexpect':48B,91C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases older than the fixed versions named in the advisory. The sources say the attack comes from the local network, so machines on untrusted or shared networks are the most exposed. Systems already on the fixed builds can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112457","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112457","severity":null,"published_at":"2026-10-26T21:17:35+00:00","modified_at":"2026-10-26T21:17:35+00:00","first_seen_at":"2026-10-26T21:20:25+00:00","fetched_at":"2026-10-26T21:20:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}