{"id":"CVE-2026-112562","kind":"vulnerability","aliases":["CVE-2026-112562"],"related":[],"title":"Apple macOS: directory path parsing flaw lets a malicious app escape sandbox","description":"A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.","summary":"A parsing flaw in how macOS handles directory paths lets a malicious app break out of its sandbox. Apple fixed it with improved path validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Run `sw_vers -productVersion` and compare the result with `27.2`, `15.8.2` or `26.7.2` for your release line\n- unknown whether the sources list any other check","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching your release line","status":"open","published_at":"2026-10-26T21:17:50+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","triaged_at":"2026-10-26T21:27:48+00:00","updated_at":"2026-10-26T21:27:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:27:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), matching your release line","reach":"local","title":"Apple macOS: directory path parsing flaw lets a malicious app escape sandbox","impact":"medium","summary":"A parsing flaw in how macOS handles directory paths lets a malicious app break out of its sandbox. Apple fixed it with improved path validation in macOS Golden Gate 27.2, Sequoia 15.8.2 and Tahoe 26.7.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Malicious app escapes its sandbox and reaches beyond its permitted files","analyst_note":"Check Apple's security notes for CVE-2026-112562 for the affected builds, exploit preconditions and whether user action is needed; the NVD entry alone gives no detail.","how_to_check":"- Run `sw_vers -productVersion` and compare the result with `27.2`, `15.8.2` or `26.7.2` for your release line\n- unknown whether the sources list any other check","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Mac machines on the affected macOS releases that run third-party or untrusted apps inside the sandbox. The sources do not say which app configurations are needed to trigger it. Machines already on the fixed builds, or with no untrusted apps installed, have less to worry about.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3293,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112562':15A,18A '-2026':14A,17A '15.8.2':55B,85C '26.7.2':58B,88C '27.2':53B,82C 'abl':94C 'address':69C 'app':10A,36B,91C 'appl':1A,20B,42B 'apple-devic':19B 'break':37B,96C 'cve':13A,16A 'devic':21B 'directori':3A,31B,66C 'escap':11A 'fix':43B,77C 'flaw':6A,26B 'gate':52B,81C 'golden':51B,80C 'handl':30B,64C 'improv':46B,71C 'infrastructur':22B 'issu':61C,75C 'let':7A,33B 'maco':2A,23B,29B,50B,79C,83C,86C 'malici':9A,35B,90C 'may':92C 'pars':5A,25B,60C 'path':4A,32B,47B,67C,72C 'sandbox':12A,41B,100C 'sequoia':54B,84C 'taho':57B,87C 'valid':48B,73C","nicknames":[],"mitigations":[],"who_affected":"Mac machines on the affected macOS releases that run third-party or untrusted apps inside the sandbox. The sources do not say which app configurations are needed to trigger it. Machines already on the fixed builds, or with no untrusted apps installed, have less to worry about.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112562","severity":null,"published_at":"2026-10-26T21:17:50+00:00","modified_at":"2026-10-26T21:17:50+00:00","first_seen_at":"2026-10-26T21:20:28+00:00","fetched_at":"2026-10-26T21:20:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}