Live › vulnerability › CVE-2026-112523
Go to dashboardApple fixed a symlink handling flaw in macOS that lets a malicious app access user-sensitive data. The sources give no further detail on the exact file paths or the attack steps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Mac running an unpatched macOS release on the affected lines. The sources do not say which apps or configurations are needed to trigger it, so the scope of exposure beyond unpatched macOS is unknown.
No product ranges from the sources yet.
sw_vers27.2 (Golden Gate), 15.8.2 (Sequoia) or 26.7.2 (Tahoe) via Software UpdateEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access user-sensitive data.
This page as .md · .json · in your agent: get_signal("CVE-2026-112523")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.