{"id":"CVE-2026-112483","kind":"vulnerability","aliases":["CVE-2026-112483"],"related":[],"title":"macOS: path handling flaw lets an app modify protected file system areas","description":"A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system.","summary":"A path handling flaw in macOS allows an app to modify parts of the file system that are meant to be protected. The sources do not say what the attacker needs beyond an installed app.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":[],"how_to_check":"- Check the installed macOS version in System Settings > General > About, or run `sw_vers -productVersion`\n- Compare it against the fixed versions listed in the Fix section\n- unknown for any other check, as the sources do not say","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), depending on the installed release\n- unknown for any other action, as the sources do not say","status":"open","published_at":"2026-10-26T21:17:39+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","triaged_at":"2026-10-26T21:30:00+00:00","updated_at":"2026-10-26T21:30:00+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:30:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), depending on the installed release\n- unknown for any other action, as the sources do not say","reach":"local","title":"macOS: path handling flaw lets an app modify protected file system areas","impact":"medium","summary":"A path handling flaw in macOS allows an app to modify parts of the file system that are meant to be protected. The sources do not say what the attacker needs beyond an installed app.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"An app modifies protected parts of the file system","analyst_note":"Sources give no CVSS score, exploit details or attack prerequisites; check Apple's security release notes for the affected builds and whether an app needs special entitlements.","how_to_check":"- Check the installed macOS version in System Settings > General > About, or run `sw_vers -productVersion`\n- Compare it against the fixed versions listed in the Fix section\n- unknown for any other check, as the sources do not say","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Mac running a macOS release older than the fixed versions is in scope, since the flaw sits in the operating system itself. The sources do not describe a specific configuration or role that makes a machine more exposed. unknown whether managed fleets or specific setups are excluded.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000601,"input_tokens":3272,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112483':15A,18A '-2026':14A,17A '15.8.2':77C '26.7.2':80C '27.2':74C 'abl':85C 'address':62C 'allow':28B 'app':7A,30B,56B,82C 'area':12A 'attack':51B 'beyond':53B 'cve':13A,16A 'endpoint':19B 'file':10A,36B,92C 'fix':69C 'flaw':4A,25B 'gate':73C 'golden':72C 'handl':3A,24B,59C 'improv':64C 'infrastructur':20B 'instal':55B 'issu':60C,67C 'let':5A 'maco':1A,21B,27B,71C,75C,78C 'may':83C 'meant':40B 'modifi':8A,32B,87C 'need':52B 'part':33B,89C 'path':2A,23B,58C 'protect':9A,43B,88C 'say':48B 'sequoia':76C 'sourc':45B 'system':11A,37B,93C 'taho':79C 'valid':65C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release older than the fixed versions is in scope, since the flaw sits in the operating system itself. The sources do not describe a specific configuration or role that makes a machine more exposed. unknown whether managed fleets or specific setups are excluded.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112483","severity":null,"published_at":"2026-10-26T21:17:39+00:00","modified_at":"2026-10-26T21:17:39+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","fetched_at":"2026-10-26T21:20:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}