{"id":"CVE-2026-112511","kind":"vulnerability","aliases":["CVE-2026-112511"],"related":[],"title":"macOS Screen Sharing: peer can create arbitrary root-owned symlinks","description":"A path handling issue was addressed with improved logic. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious Screen Sharing peer may be able to create arbitrary symlinks as root.","summary":"A path handling flaw in macOS Screen Sharing lets a malicious connected peer create arbitrary symbolic links as root. An attacker can use this to redirect privileged file writes and reach files outside the intended location.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","macos","screen-sharing","self-hosted"],"not_affected_if":["patched-macos","screen-sharing-disabled"],"how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it against the fixed builds listed below.\n- Check whether Screen Sharing is enabled in System Settings under General, Sharing.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later.\n- Disable Screen Sharing if it is not needed.","status":"open","published_at":"2026-10-26T21:17:42+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:29:39+00:00","updated_at":"2026-10-26T21:29:39+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:29:39Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later.\n- Disable Screen Sharing if it is not needed.","reach":"network","title":"macOS Screen Sharing: peer can create arbitrary root-owned symlinks","impact":"high","summary":"A path handling flaw in macOS Screen Sharing lets a malicious connected peer create arbitrary symbolic links as root. An attacker can use this to redirect privileged file writes and reach files outside the intended location.","category":"infrastructure","nicknames":[],"who_cares":["macos","screen-sharing","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A remote peer creates root-level symlinks that redirect privileged file writes.","analyst_note":"Confirm the affected version range and whether a valid Screen Sharing login is required, using the Apple security notes for these builds.","how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it against the fixed builds listed below.\n- Check whether Screen Sharing is enabled in System Settings under General, Sharing.","needs_analyst":true,"not_affected_if":["screen-sharing-disabled","patched-macos"],"who_is_affected":"Macs with Screen Sharing enabled that accept connections from other hosts are exposed, since the flaw needs a malicious peer on that session. Machines where Screen Sharing is off, or that are not reachable by untrusted peers, are much less exposed. unknown for exact affected build ranges beyond the fixed versions named in the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00063,"input_tokens":3285,"output_tokens":602,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112511':14A,17A '-2026':13A,16A '15.8.2':82C '26.7.2':85C '27.2':79C 'abl':93C 'address':67C 'arbitrari':7A,40B,96C 'attack':46B 'connect':37B 'creat':6A,39B,95C 'cve':12A,15A 'file':53B,57B 'fix':74C 'flaw':29B 'gate':78C 'golden':77C 'handl':28B,64C 'host':25B 'improv':69C 'infrastructur':18B 'intend':60B 'issu':65C,72C 'let':34B 'link':42B 'locat':61B 'logic':70C 'maco':1A,19B,31B,76C,80C,83C 'malici':36B,87C 'may':91C 'outsid':58B 'own':10A 'path':27B,63C 'peer':4A,38B,90C 'privileg':52B 'reach':56B 'redirect':51B 'root':9A,44B,99C 'root-own':8A 'screen':2A,21B,32B,88C 'screen-shar':20B 'self':24B 'self-host':23B 'sequoia':81C 'share':3A,22B,33B,89C 'symbol':41B 'symlink':11A,97C 'taho':84C 'use':48B 'write':54B","nicknames":[],"mitigations":[],"who_affected":"Macs with Screen Sharing enabled that accept connections from other hosts are exposed, since the flaw needs a malicious peer on that session. Machines where Screen Sharing is off, or that are not reachable by untrusted peers, are much less exposed. unknown for exact affected build ranges beyond the fixed versions named in the description.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112511","severity":null,"published_at":"2026-10-26T21:17:42+00:00","modified_at":"2026-10-26T21:17:42+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}