Live › vulnerability › CVE-2026-112556
Go to dashboardA race condition in macOS allows an attacker to tamper with code-signed applications so that arbitrary code runs in the application's context. Apple fixed it with additional validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Any Mac running a macOS release that predates these fixes. The sources do not say which specific configuration or application state is required to trigger the race, so the exact exposure is unknown. Machines already on the fixed releases are not affected.
No product ranges from the sources yet.
sw_vers -productVersion on each Mac to see whether it is below 27.2, 15.8.2 or 26.7.2 for its release line27.2 (Golden Gate), 15.8.2 (Sequoia) or 26.7.2 (Tahoe), matching the installed major releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.
This page as .md · .json · in your agent: get_signal("CVE-2026-112556")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.