{"id":"CVE-2026-113938","kind":"vulnerability","aliases":["CVE-2026-113938"],"related":[],"title":"Apple macOS: out-of-bounds read lets an app crash the system","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds read in macOS could be triggered by an app, causing unexpected system termination. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["macos-27.2-or-later"],"how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare against `27.2`\n- unknown for any other specific check","fix":"- Update macOS to `27.2` (Golden Gate) or later via System Settings > General > Software Update","status":"open","published_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:45+00:00","updated_at":"2026-10-26T21:21:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:21:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate) or later via System Settings > General > Software Update","reach":"local","title":"Apple macOS: out-of-bounds read lets an app crash the system","impact":"low","summary":"An out-of-bounds read in macOS could be triggered by an app, causing unexpected system termination. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unexpected system termination caused by a local app","analyst_note":"","how_to_check":"- Run `sw_vers -productVersion` on the Mac and compare against `27.2`\n- unknown for any other specific check","needs_analyst":false,"not_affected_if":["macos-27.2-or-later"],"who_is_affected":"Macs running macOS releases earlier than Golden Gate 27.2. The sources do not name the affected component or the code path, so the exact exposure is unknown. Managed fleets that already run 27.2 can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000538,"input_tokens":3253,"output_tokens":425,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113938':16A,19A '-2026':15A,18A '27.2':54B,75C 'abl':80C 'address':62C 'app':10A,38B,77C 'appl':1A,21B,43B 'apple-devic':20B 'bound':6A,29B,48B,59C,65C 'caus':39B,82C 'check':49B,66C 'could':33B 'crash':11A 'cve':14A,17A 'devic':22B 'fix':44B,70C 'gate':53B,74C 'golden':52B,73C 'improv':47B,64C 'infrastructur':23B 'issu':68C 'let':8A 'maco':2A,24B,32B,51B,72C 'may':78C 'out-of-bound':3A,26B,56C 'read':7A,30B,60C 'system':13A,41B,84C 'termin':42B,85C 'trigger':35B 'unexpect':40B,83C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases earlier than Golden Gate 27.2. The sources do not name the affected component or the code path, so the exact exposure is unknown. Managed fleets that already run 27.2 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113938","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113938","severity":null,"published_at":"2026-10-26T21:18:09+00:00","modified_at":"2026-10-26T21:18:09+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}