{"id":"CVE-2026-113947","kind":"vulnerability","aliases":["CVE-2026-113947"],"related":[],"title":"macOS: crafted archive unpacking can crash apps or run code","description":"This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.","summary":"Unpacking a maliciously crafted archive on macOS can terminate an app unexpectedly or, per the advisory, allow arbitrary code execution. The sources say the fix is an access restriction change in macOS Golden Gate 27.2.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","infrastructure","macos"],"not_affected_if":["already-patched"],"how_to_check":"- unknown","fix":"- Update macOS to Golden Gate 27.2 or later (version string as given by the source: `27.2`).","status":"open","published_at":"2026-10-26T21:18:11+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","triaged_at":"2026-10-26T21:21:04+00:00","updated_at":"2026-10-26T21:21:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:21:04Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27.2 or later (version string as given by the source: `27.2`).","reach":"local","title":"macOS: crafted archive unpacking can crash apps or run code","impact":"high","summary":"Unpacking a maliciously crafted archive on macOS can terminate an app unexpectedly or, per the advisory, allow arbitrary code execution. The sources say the fix is an access restriction change in macOS Golden Gate 27.2.","category":"infrastructure","nicknames":[],"who_cares":["macos","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Arbitrary code may run when a crafted archive is unpacked","analyst_note":"Check Apple's security notes for Golden Gate 27.2 to confirm the affected archive handling component, the CVSS vector and whether the code execution is confirmed.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Macs running macOS releases before Golden Gate 27.2 that unpack archives from untrusted sources are exposed. Systems already on 27.2 or later are not affected by this issue. The sources do not say which archive formats or apps are involved.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00056,"input_tokens":3268,"output_tokens":466,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113947':13A,16A '-2026':12A,15A '27.2':54B,71C 'access':47B,61C 'address':58C 'advisori':35B 'allow':36B 'app':7A,30B,81C 'arbitrari':37B,84C 'archiv':3A,24B,76C 'chang':49B 'code':10A,38B,85C 'craft':2A,23B,75C 'crash':6A 'cve':11A,14A 'desktop':17B 'execut':39B,86C 'fix':44B,66C 'gate':53B,70C 'golden':52B,69C 'improv':60C 'infrastructur':18B 'issu':56C,64C 'lead':78C 'maco':1A,19B,26B,51B,68C 'malici':22B,74C 'may':77C 'per':33B 'restrict':48B,62C 'run':9A 'say':42B 'sourc':41B 'termin':28B,82C 'unexpect':31B,80C 'unpack':4A,20B,72C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases before Golden Gate 27.2 that unpack archives from untrusted sources are exposed. Systems already on 27.2 or later are not affected by this issue. The sources do not say which archive formats or apps are involved.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113947","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113947","severity":null,"published_at":"2026-10-26T21:18:11+00:00","modified_at":"2026-10-26T21:18:11+00:00","first_seen_at":"2026-10-26T21:20:31+00:00","fetched_at":"2026-10-26T21:20:31+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}