{"id":"CVE-2026-113936","kind":"vulnerability","aliases":["CVE-2026-113936"],"related":[],"title":"Apple macOS: out-of-bounds read can crash the system","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds read in macOS let an app trigger an unexpected system termination, according to Apple's note. The fix is in macOS Golden Gate 27.2, and the sources give no sign of code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-on-macos-27.2-or-later"],"how_to_check":"- Run `sw_vers -productVersion` to see the installed macOS version\n- unknown","fix":"- Update macOS to `Golden Gate 27.2` or later via System Settings > General > Software Update","status":"open","published_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:48+00:00","updated_at":"2026-10-26T21:21:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:21:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `Golden Gate 27.2` or later via System Settings > General > Software Update","reach":"local","title":"Apple macOS: out-of-bounds read can crash the system","impact":"low","summary":"An out-of-bounds read in macOS let an app trigger an unexpected system termination, according to Apple's note. The fix is in macOS Golden Gate 27.2, and the sources give no sign of code execution or data theft.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A local app can crash the system","analyst_note":"Check Apple's security notes for CVE-2026-113936 for the affected builds and whether the trigger needs a local app or more.","how_to_check":"- Run `sw_vers -productVersion` to see the installed macOS version\n- unknown","needs_analyst":true,"not_affected_if":["already-on-macos-27.2-or-later"],"who_is_affected":"Machines running macOS builds older than Golden Gate 27.2. The sources do not say which configurations or app types are needed to reach the flaw, so unknown beyond the affected OS version.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000551,"input_tokens":3253,"output_tokens":451,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113936':14A,17A '-2026':13A,16A '27.2':51B,84C 'abl':89C 'accord':39B 'address':71C 'app':33B,86C 'appl':1A,19B,41B 'apple-devic':18B 'bound':6A,27B,68C,74C 'caus':91C 'check':75C 'code':59B 'crash':9A 'cve':12A,15A 'data':62B 'devic':20B 'execut':60B 'fix':45B,79C 'gate':50B,83C 'give':55B 'golden':49B,82C 'improv':73C 'infrastructur':21B 'issu':77C 'let':31B 'maco':2A,22B,30B,48B,81C 'may':87C 'note':43B 'out-of-bound':3A,24B,65C 'read':7A,28B,69C 'sign':57B 'sourc':54B 'system':11A,37B,93C 'termin':38B,94C 'theft':63B 'trigger':34B 'unexpect':36B,92C","nicknames":[],"mitigations":[],"who_affected":"Machines running macOS builds older than Golden Gate 27.2. The sources do not say which configurations or app types are needed to reach the flaw, so unknown beyond the affected OS version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113936","severity":null,"published_at":"2026-10-26T21:18:09+00:00","modified_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}