{"id":"CVE-2026-113942","kind":"vulnerability","aliases":["CVE-2026-113942"],"related":[],"title":"macOS: out-of-bounds read lets an app crash the system or read kernel memory","description":"An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected system termination or read kernel memory.","summary":"An out-of-bounds read in macOS lets an app cause an unexpected system termination or read kernel memory. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["already-on-27.2"],"how_to_check":"- Check the macOS version on each machine with `sw_vers -productVersion`\n- unknown","fix":"- Update macOS to `Golden Gate 27.2` or later\n- unknown","status":"open","published_at":"2026-10-26T21:18:10+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:42+00:00","updated_at":"2026-10-26T21:21:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-26T21:21:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `Golden Gate 27.2` or later\n- unknown","reach":"local","title":"macOS: out-of-bounds read lets an app crash the system or read kernel memory","impact":"medium","summary":"An out-of-bounds read in macOS lets an app cause an unexpected system termination or read kernel memory. Apple fixed it with improved bounds checking in macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.6,"needs_auth":"unknown","worst_case":"App can crash the system or read kernel memory","analyst_note":"Check Apple's security notes for CVE-2026-113942 to confirm affected builds, required privileges and any user interaction.","how_to_check":"- Check the macOS version on each machine with `sw_vers -productVersion`\n- unknown","needs_analyst":true,"not_affected_if":["already-on-27.2"],"who_is_affected":"Machines running macOS releases before Golden Gate 27.2 are affected, since any local app may be able to trigger the read. Fleets already on 27.2 or later are not affected by this issue. The sources do not say which earlier builds are impacted.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000557,"input_tokens":3260,"output_tokens":462,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-113942':19A,22A '-2026':18A,21A '27.2':57B,78C 'abl':83C 'address':65C 'app':9A,36B,80C 'appl':46B 'bound':5A,30B,51B,62C,68C 'caus':37B,85C 'check':52B,69C 'crash':10A 'cve':17A,20A 'endpoint':23B 'fix':47B,73C 'gate':56B,77C 'golden':55B,76C 'improv':50B,67C 'infrastructur':24B 'issu':71C 'kernel':15A,44B,91C 'let':7A,34B 'maco':1A,25B,33B,54B,75C 'may':81C 'memori':16A,45B,92C 'out-of-bound':2A,27B,59C 'read':6A,14A,31B,43B,63C,90C 'system':12A,40B,87C 'termin':41B,88C 'unexpect':39B,86C","nicknames":[],"mitigations":[],"who_affected":"Machines running macOS releases before Golden Gate 27.2 are affected, since any local app may be able to trigger the read. Fleets already on 27.2 or later are not affected by this issue. The sources do not say which earlier builds are impacted.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113942","severity":null,"published_at":"2026-10-26T21:18:10+00:00","modified_at":"2026-10-26T21:18:10+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}