{"id":"CVE-2026-112539","kind":"vulnerability","aliases":["CVE-2026-112539"],"related":[],"title":"macOS: a malicious app can read or write protected files","description":"A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to read or write to protected files.","summary":"Apple fixed a permissions flaw in macOS where a malicious app could access protected files. An attacker who gets a malicious app onto a Mac can read or write files that should be off limits to it.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","macos","other"],"not_affected_if":["already-patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare the result with the fixed builds below\n- Check for a pending update in System Settings > General > Software Update","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later","status":"open","published_at":"2026-10-26T21:17:46+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","triaged_at":"2026-10-26T21:28:10+00:00","updated_at":"2026-10-26T21:28:10+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-26T21:28:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) or later","reach":"local","title":"macOS: a malicious app can read or write protected files","impact":"medium","summary":"Apple fixed a permissions flaw in macOS where a malicious app could access protected files. An attacker who gets a malicious app onto a Mac can read or write files that should be off limits to it.","category":"other","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Malicious app reads or writes protected user files on the Mac","analyst_note":"Check Apple's security notes for CVE-2026-112539 for the affected component, the attack prerequisites and whether a fix in a specific build exists.","how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare the result with the fixed builds below\n- Check for a pending update in System Settings > General > Software Update","needs_analyst":true,"not_affected_if":["already-patched-macos"],"who_is_affected":"Any Mac running a macOS release older than the fixed versions. The sources do not say which configurations are most exposed. The attack needs a malicious app to be run on the machine first.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000569,"input_tokens":3276,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112539':13A,16A '-2026':12A,15A '15.8.2':75C '26.7.2':78C '27.2':72C 'abl':84C 'access':33B 'addit':62C 'address':60C 'app':4A,31B,42B,81C 'appl':18B,21B 'apple-devic':17B 'attack':37B 'could':32B 'cve':11A,14A 'devic':19B 'file':10A,35B,50B,91C 'fix':22B,67C 'flaw':25B 'gate':71C 'get':39B 'golden':70C 'issu':58C,65C 'limit':55B 'mac':45B 'maco':1A,20B,27B,69C,73C,76C 'malici':3A,30B,41B,80C 'may':82C 'onto':43B 'permiss':24B,57C 'protect':9A,34B,90C 'read':6A,47B,86C 'restrict':63C 'sequoia':74C 'taho':77C 'write':8A,49B,88C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release older than the fixed versions. The sources do not say which configurations are most exposed. The attack needs a malicious app to be run on the machine first.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112539","severity":null,"published_at":"2026-10-26T21:17:46+00:00","modified_at":"2026-10-26T21:17:46+00:00","first_seen_at":"2026-10-26T21:20:27+00:00","fetched_at":"2026-10-26T21:20:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}