{"id":"CVE-2026-113940","kind":"vulnerability","aliases":["CVE-2026-113940"],"related":[],"title":"macOS: out-of-bounds read lets an app crash the system","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds read in macOS could let an app trigger an unexpected system termination. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-on-macos-golden-gate-27.2"],"how_to_check":"- unknown","fix":"- Update macOS to Golden Gate 27.2 or later (version string as given by the advisory; confirm in System Settings > General > Software Update).","status":"open","published_at":"2026-10-26T21:18:10+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:44+00:00","updated_at":"2026-10-26T21:21:44+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:21:44Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27.2 or later (version string as given by the advisory; confirm in System Settings > General > Software Update).","reach":"local","title":"macOS: out-of-bounds read lets an app crash the system","impact":"low","summary":"An out-of-bounds read in macOS could let an app trigger an unexpected system termination. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A local app crashes the system unexpectedly","analyst_note":"Check Apple's security notes for CVE-2026-113940 to confirm affected versions, the exact fixed build, and whether the trigger is local only.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["already-on-macos-golden-gate-27.2"],"who_is_affected":"Macs running macOS releases earlier than Golden Gate 27.2 are affected according to the description. The sources do not say which configurations or hardware are needed, so unknown whether any setup is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000547,"input_tokens":3253,"output_tokens":443,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113940':15A,18A '-2026':14A,17A '27.2':52B,73C 'abl':78C 'address':60C 'app':9A,35B,75C 'appl':20B,41B 'apple-devic':19B 'bound':5A,28B,46B,57C,63C 'caus':80C 'check':47B,64C 'could':32B 'crash':10A 'cve':13A,16A 'devic':21B 'fix':42B,68C 'gate':51B,72C 'golden':50B,71C 'improv':45B,62C 'infrastructur':22B 'issu':66C 'let':7A,33B 'maco':1A,23B,31B,49B,70C 'may':76C 'out-of-bound':2A,25B,54C 'read':6A,29B,58C 'system':12A,39B,82C 'termin':40B,83C 'trigger':36B 'unexpect':38B,81C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases earlier than Golden Gate 27.2 are affected according to the description. The sources do not say which configurations or hardware are needed, so unknown whether any setup is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113940","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113940","severity":null,"published_at":"2026-10-26T21:18:10+00:00","modified_at":"2026-10-26T21:18:10+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}