Live › vulnerability › CVE-2026-112513
Go to dashboardA symlink validation flaw in macOS lets a local app break out of its sandbox. The fix ships in macOS Golden Gate 27.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Mac running a macOS release before Golden Gate 27.2 is affected, since the flaw is in the operating system's symlink handling. The sources do not say which earlier releases are vulnerable, so treat all of them as affected. Machines already on 27.2 or later can skip it.
No product ranges from the sources yet.
sw_vers -productVersion on each Mac and compare against the fixed release.27.2 or later (Golden Gate).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Golden Gate 27.2. An app may be able to break out of its sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-112513")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.