{"id":"CVE-2026-113937","kind":"vulnerability","aliases":["CVE-2026-113937"],"related":[],"title":"Apple macOS: out-of-bounds read lets an app crash the system","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds read in macOS was fixed with improved bounds checking in macOS Golden Gate 27.2. A malicious app may be able to cause an unexpected system termination.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","endpoints","infrastructure","macos"],"not_affected_if":["macos-27.2-or-later"],"how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare it to the fixed release, macOS Golden Gate 27.2.","fix":"- Update macOS to `27.2` or later through Software Update.","status":"open","published_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:47+00:00","updated_at":"2026-10-26T21:21:47+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:21:47Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` or later through Software Update.","reach":"local","title":"Apple macOS: out-of-bounds read lets an app crash the system","impact":"low","summary":"An out-of-bounds read in macOS was fixed with improved bounds checking in macOS Golden Gate 27.2. A malicious app may be able to cause an unexpected system termination.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unexpected system termination, a denial of service on the Mac.","analyst_note":"Check Apple's security release notes for macOS Golden Gate 27.2 to confirm the affected component and whether the trigger is local or remote.","how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare it to the fixed release, macOS Golden Gate 27.2.","needs_analyst":true,"not_affected_if":["macos-27.2-or-later"],"who_is_affected":"Macs running macOS releases earlier than Golden Gate 27.2 are affected. The sources do not say which component or entry point triggers the read, so the exact exposure is unknown. Servers and fleets that already run 27.2 or later can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000565,"input_tokens":3253,"output_tokens":479,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113937':16A,19A '-2026':15A,18A '27.2':42B,75C 'abl':48B,80C 'address':62C 'app':10A,45B,77C 'appl':1A,20B 'bound':6A,28B,36B,59C,65C 'caus':50B,82C 'check':37B,66C 'crash':11A 'cve':14A,17A 'endpoint':21B 'fix':33B,70C 'gate':41B,74C 'golden':40B,73C 'improv':35B,64C 'infrastructur':22B 'issu':68C 'let':8A 'maco':2A,23B,31B,39B,72C 'malici':44B 'may':46B,78C 'out-of-bound':3A,25B,56C 'read':7A,29B,60C 'system':13A,53B,84C 'termin':54B,85C 'unexpect':52B,83C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases earlier than Golden Gate 27.2 are affected. The sources do not say which component or entry point triggers the read, so the exact exposure is unknown. Servers and fleets that already run 27.2 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113937","severity":null,"published_at":"2026-10-26T21:18:09+00:00","modified_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}