{"id":"CVE-2026-112521","kind":"vulnerability","aliases":["CVE-2026-112521"],"related":[],"title":"macOS: buffer overflow lets a sandboxed process escape its sandbox","description":"A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A sandboxed process may be able to circumvent sandbox restrictions.","summary":"A buffer overflow in macOS lets a sandboxed process get around its sandbox restrictions. Apple fixed it with better bounds checking in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare the result with the fixed versions above.\n- unknown for anything beyond the OS version; the sources do not name a specific setting or file.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), whichever matches the installed major release.","status":"open","published_at":"2026-10-26T21:17:44+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:29:27+00:00","updated_at":"2026-10-26T21:29:27+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:29:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), whichever matches the installed major release.","reach":"local","title":"macOS: buffer overflow lets a sandboxed process escape its sandbox","impact":"medium","summary":"A buffer overflow in macOS lets a sandboxed process get around its sandbox restrictions. Apple fixed it with better bounds checking in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A sandboxed process escapes its restrictions and reaches the rest of the system.","analyst_note":"Sources give only the NVD entry and Apple's wording; check Apple's security release notes for the exact CVE details and whether the bug needs a user action or a specific app.","how_to_check":"- Run `sw_vers -productVersion` and compare the result with the fixed versions above.\n- unknown for anything beyond the OS version; the sources do not name a specific setting or file.","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running a macOS release older than the fixed versions can be affected. The sources do not say which sandboxed processes or apps are needed to reach the flaw, so the exposure of a given app is unknown. Machines already on the fixed builds are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000615,"input_tokens":3287,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112521':13A,16A '-2026':12A,15A '15.8.2':49B,73C '26.7.2':52B,76C '27.2':47B,70C 'abl':82C 'address':57C 'appl':18B,36B 'apple-devic':17B 'around':32B 'better':40B 'bound':41B,60C 'buffer':2A,23B,54C 'check':42B,61C 'circumv':84C 'cve':11A,14A 'devic':19B 'escap':8A 'fix':37B,65C 'gate':46B,69C 'get':31B 'golden':45B,68C 'improv':59C 'infrastructur':20B 'issu':63C 'let':4A,27B 'maco':1A,21B,26B,44B,67C,71C,74C 'may':80C 'overflow':3A,24B,55C 'process':7A,30B,79C 'restrict':35B,86C 'sandbox':6A,10A,29B,34B,78C,85C 'sequoia':48B,72C 'taho':51B,75C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release older than the fixed versions can be affected. The sources do not say which sandboxed processes or apps are needed to reach the flaw, so the exposure of a given app is unknown. Machines already on the fixed builds are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112521","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112521","severity":null,"published_at":"2026-10-26T21:17:44+00:00","modified_at":"2026-10-26T21:17:44+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}