{"id":"CVE-2026-112484","kind":"vulnerability","aliases":["CVE-2026-112484"],"related":[],"title":"macOS: improved file handling lets a malicious app run code as system","description":"This issue was addressed with improved file handling. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious application may be able to execute arbitrary code with system privileges.","summary":"Apple fixed a flaw in macOS file handling that lets a malicious application execute arbitrary code with system privileges. The sources do not name the exact component affected.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","endpoints","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) via Software Update.","status":"open","published_at":"2026-10-26T21:17:39+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","triaged_at":"2026-10-26T21:29:58+00:00","updated_at":"2026-10-26T21:29:58+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:29:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) via Software Update.","reach":"local","title":"macOS: improved file handling lets a malicious app run code as system","impact":"high","summary":"Apple fixed a flaw in macOS file handling that lets a malicious application execute arbitrary code with system privileges. The sources do not name the exact component affected.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices","endpoints"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Malicious app runs arbitrary code with system privileges on the Mac.","analyst_note":"Check Apple's security release notes for the affected component and the exact vulnerable version ranges; the NVD entry gives no CPE detail.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2.","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running an unpatched macOS release is potentially exposed, since the flaw is reached by a malicious application already on the machine. Systems already on the listed fixed versions or later are not affected. The sources do not say which macOS versions before the fix are vulnerable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000594,"input_tokens":3274,"output_tokens":533,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112484':15A,18A '-2026':14A,17A '15.8.2':72C '26.7.2':75C '27.2':69C 'abl':81C 'address':56C 'affect':52B 'app':8A 'appl':20B,25B 'apple-devic':19B 'applic':37B,78C 'arbitrari':39B,84C 'code':10A,40B,85C 'compon':51B 'cve':13A,16A 'devic':21B 'endpoint':22B 'exact':50B 'execut':38B,83C 'file':3A,31B,59C 'fix':26B,64C 'flaw':28B 'gate':68C 'golden':67C 'handl':4A,32B,60C 'improv':2A,58C 'infrastructur':23B 'issu':54C,62C 'let':5A,34B 'maco':1A,24B,30B,66C,70C,73C 'malici':7A,36B,77C 'may':79C 'name':48B 'privileg':43B,88C 'run':9A 'sequoia':71C 'sourc':45B 'system':12A,42B,87C 'taho':74C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running an unpatched macOS release is potentially exposed, since the flaw is reached by a malicious application already on the machine. Systems already on the listed fixed versions or later are not affected. The sources do not say which macOS versions before the fix are vulnerable.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112484","severity":null,"published_at":"2026-10-26T21:17:39+00:00","modified_at":"2026-10-26T21:17:39+00:00","first_seen_at":"2026-10-26T21:20:26+00:00","fetched_at":"2026-10-26T21:20:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}