Live › vulnerability › CVE-2026-112562
Go to dashboardA parsing flaw in how macOS handles directory paths lets a malicious app break out of its sandbox. Apple fixed it with improved path validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 21:20 UTC. All times on this page are UTC.
Mac machines on the affected macOS releases that run third-party or untrusted apps inside the sandbox. The sources do not say which app configurations are needed to trigger it. Machines already on the fixed builds, or with no untrusted apps installed, have less to worry about.
No product ranges from the sources yet.
sw_vers -productVersion and compare the result with 27.2, 15.8.2 or 26.7.2 for your release line27.2 (Golden Gate), 15.8.2 (Sequoia) or 26.7.2 (Tahoe), matching your release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-112562")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.