{"id":"CVE-2026-112481","kind":"vulnerability","aliases":["CVE-2026-112481"],"related":[],"title":"macOS: out-of-bounds read lets a network attacker crash processes or leak memory","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker on the local network may be able to cause unexpected process termination or disclose process memory.","summary":"An out-of-bounds read in a macOS component lets an attacker on the local network terminate a process or read its memory. Apple fixed it with improved bounds checking.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed below.\n- unknown","fix":"- Update macOS Golden Gate to `27.2`, macOS Sequoia to `15.8.2`, or macOS Tahoe to `26.7.2`.","status":"open","published_at":"2026-10-26T21:17:38+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","triaged_at":"2026-10-26T21:30:02+00:00","updated_at":"2026-10-26T21:30:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:30:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS Golden Gate to `27.2`, macOS Sequoia to `15.8.2`, or macOS Tahoe to `26.7.2`.","reach":"network","title":"macOS: out-of-bounds read lets a network attacker crash processes or leak memory","impact":"medium","summary":"An out-of-bounds read in a macOS component lets an attacker on the local network terminate a process or read its memory. Apple fixed it with improved bounds checking.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker crashes a process or reads its memory over the local network.","analyst_note":"Identify the affected macOS component and the triggering network service from Apple's security notes; the NVD entry gives no detail.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed below.\n- unknown","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Macs running macOS versions earlier than the fixed releases named in the advisory, reachable from the local network. The sources do not name the affected component, so unknown whether servers or only laptops are more exposed. Machines already on the fixed versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000573,"input_tokens":3296,"output_tokens":486,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112481':18A,21A '-2026':17A,20A '15.8.2':81C '26.7.2':84C '27.2':78C 'abl':93C 'address':65C 'appl':23B,51B 'apple-devic':22B 'attack':10A,39B,86C 'bound':5A,31B,56B,62C,68C 'caus':95C 'check':57B,69C 'compon':36B 'crash':11A 'cve':16A,19A 'devic':24B 'disclos':100C 'fix':52B,73C 'gate':77C 'golden':76C 'improv':55B,67C 'infrastructur':25B 'issu':71C 'leak':14A 'let':7A,37B 'local':42B,89C 'maco':1A,26B,35B,75C,79C,82C 'may':91C 'memori':15A,50B,102C 'network':9A,43B,90C 'out-of-bound':2A,28B,59C 'process':12A,46B,97C,101C 'read':6A,32B,48B,63C 'sequoia':80C 'taho':83C 'termin':44B,98C 'unexpect':96C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS versions earlier than the fixed releases named in the advisory, reachable from the local network. The sources do not name the affected component, so unknown whether servers or only laptops are more exposed. Machines already on the fixed versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112481","severity":null,"published_at":"2026-10-26T21:17:38+00:00","modified_at":"2026-10-26T21:17:38+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","fetched_at":"2026-10-26T21:20:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}