{"id":"CVE-2026-112556","kind":"vulnerability","aliases":["CVE-2026-112556"],"related":[],"title":"macOS: race condition lets attackers tamper with signed apps","description":"A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.","summary":"A race condition in macOS allows an attacker to tamper with code-signed applications so that arbitrary code runs in the application's context. Apple fixed it with additional validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","mac-fleet","macos"],"not_affected_if":["already-patched-macos"],"how_to_check":"- `sw_vers -productVersion` on each Mac to see whether it is below `27.2`, `15.8.2` or `26.7.2` for its release line\n- Check Software Update in System Settings for pending macOS updates","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching the installed major release","status":"open","published_at":"2026-10-26T21:17:49+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:55+00:00","updated_at":"2026-10-26T21:27:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:27:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching the installed major release","reach":"local","title":"macOS: race condition lets attackers tamper with signed apps","impact":"high","summary":"A race condition in macOS allows an attacker to tamper with code-signed applications so that arbitrary code runs in the application's context. Apple fixed it with additional validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","mac-fleet","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code inside a signed application's context","analyst_note":"Check Apple's security notes for CVE-2026-112556 to confirm the attack prerequisites, reach and whether user interaction is needed.","how_to_check":"- `sw_vers -productVersion` on each Mac to see whether it is below `27.2`, `15.8.2` or `26.7.2` for its release line\n- Check Software Update in System Settings for pending macOS updates","needs_analyst":true,"not_affected_if":["already-patched-macos"],"who_is_affected":"Any Mac running a macOS release that predates these fixes. The sources do not say which specific configuration or application state is required to trigger the race, so the exact exposure is unknown. Machines already on the fixed releases are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":3281,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112556':12A,15A '-2026':11A,14A '15.8.2':59B,82C '26.7.2':62B,85C '27.2':57B,79C 'addit':51B,69C 'address':67C 'allow':27B 'app':9A 'appl':47B 'applic':36B,44B,94C,101C 'arbitrari':39B,97C 'attack':5A,29B,87C 'code':34B,40B,92C,98C 'code-sign':33B,91C 'condit':3A,24B,65C 'context':46B,103C 'cve':10A,13A 'endpoint':16B 'execut':96C 'fix':48B,74C 'fleet':20B 'gate':56B,78C 'golden':55B,77C 'infrastructur':17B 'issu':72C 'let':4A 'mac':19B 'mac-fleet':18B 'maco':1A,21B,26B,54B,76C,80C,83C 'may':88C 'race':2A,23B,64C 'run':41B 'sequoia':58B,81C 'sign':8A,35B,93C 'taho':61B,84C 'tamper':6A,31B,89C 'valid':52B,70C","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release that predates these fixes. The sources do not say which specific configuration or application state is required to trigger the race, so the exact exposure is unknown. Machines already on the fixed releases are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112556","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112556","severity":null,"published_at":"2026-10-26T21:17:49+00:00","modified_at":"2026-10-26T21:17:49+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}