{"id":"CVE-2026-112555","kind":"vulnerability","aliases":["CVE-2026-112555"],"related":[],"title":"macOS: input validation flaw lets a malicious app escape its sandbox","description":"A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.","summary":"A validation flaw in macOS was fixed with improved input sanitization. A malicious app can use it to break out of its sandbox.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed in the advisory.\n- unknown","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) via Software Update.","status":"open","published_at":"2026-10-26T21:17:48+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:56+00:00","updated_at":"2026-10-26T21:27:56+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:27:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe) via Software Update.","reach":"local","title":"macOS: input validation flaw lets a malicious app escape its sandbox","impact":"medium","summary":"A validation flaw in macOS was fixed with improved input sanitization. A malicious app can use it to break out of its sandbox.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Malicious app escapes sandbox and reaches system resources","analyst_note":"Check Apple's security notes for CVE-2026-112555 for affected version ranges, severity and whether exploitation was observed.","how_to_check":"- Run `sw_vers -productVersion` and compare against the fixed builds listed in the advisory.\n- unknown","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Any Mac running an affected macOS release can be exposed to a malicious app that is already installed and running. The sources do not say which earlier builds are affected beyond the fixed versions, so unknown for finer scope. Machines already on the fixed versions are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000568,"input_tokens":3277,"output_tokens":481,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112555':14A,17A '-2026':13A,16A '15.8.2':64C '26.7.2':67C '27.2':61C 'abl':73C 'address':48C 'app':8A,34B,70C 'break':39B,75C 'cve':12A,15A 'endpoint':18B 'escap':9A 'fix':27B,56C 'flaw':4A,23B 'gate':60C 'golden':59C 'improv':29B,50C 'infrastructur':19B 'input':2A,30B,51C 'issu':46C,54C 'let':5A 'maco':1A,20B,25B,58C,62C,65C 'malici':7A,33B,69C 'may':71C 'sandbox':11A,43B,79C 'sanit':31B,52C 'sequoia':63C 'taho':66C 'use':36B 'valid':3A,22B,45C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running an affected macOS release can be exposed to a malicious app that is already installed and running. The sources do not say which earlier builds are affected beyond the fixed versions, so unknown for finer scope. Machines already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112555","severity":null,"published_at":"2026-10-26T21:17:48+00:00","modified_at":"2026-10-26T21:17:48+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}