{"id":"CVE-2026-65384","kind":"vulnerability","aliases":["CVE-2026-65384"],"related":[],"title":"macOS: out-of-bounds read lets a remote attacker crash a process","description":"An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27.2. A remote attacker may cause an unexpected process termination.","summary":"An out-of-bounds read in macOS input handling can be triggered remotely to terminate a process. The sources describe a crash, not code execution or data theft.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it to the fixed release.\n- unknown","fix":"- Update macOS to `Golden Gate 27.2` or later via Software Update.","status":"open","published_at":"2026-10-26T21:18:45+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","triaged_at":"2026-10-26T21:21:24+00:00","updated_at":"2026-10-26T21:21:24+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-26T21:21:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `Golden Gate 27.2` or later via Software Update.","reach":"network","title":"macOS: out-of-bounds read lets a remote attacker crash a process","impact":"low","summary":"An out-of-bounds read in macOS input handling can be triggered remotely to terminate a process. The sources describe a crash, not code execution or data theft.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker crashes a process causing denial of service.","analyst_note":"Identify the affected component and the triggering input from Apple's security notes for macOS Golden Gate 27.2 and the NVD entry.","how_to_check":"- Check the macOS version with `sw_vers -productVersion` and compare it to the fixed release.\n- unknown","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Macs running macOS releases earlier than Golden Gate 27.2. The sources do not name the specific component or input path, so whether a given service is reachable is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000541,"input_tokens":3255,"output_tokens":430,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-65384':16A,19A '27.2':73C 'address':60C 'attack':10A,76C 'bound':5A,27B,56C 'caus':78C 'code':47B 'crash':11A,45B 'cve':14A,17A 'data':50B 'describ':43B 'endpoint':20B 'execut':48B 'fix':68C 'gate':72C 'golden':71C 'handl':32B 'improv':62C 'infrastructur':21B 'input':31B,63C 'issu':58C,66C 'let':7A 'maco':1A,22B,30B,70C 'may':77C 'out-of-bound':2A,24B,53C 'process':13A,40B,81C 'read':6A,28B,57C 'remot':9A,36B,75C 'sourc':42B 'termin':38B,82C 'theft':51B 'trigger':35B 'unexpect':80C 'valid':64C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases earlier than Golden Gate 27.2. The sources do not name the specific component or input path, so whether a given service is reachable is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:45+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65384","severity":null,"published_at":"2026-10-26T21:18:45+00:00","modified_at":"2026-10-26T21:18:45+00:00","first_seen_at":"2026-10-26T21:20:32+00:00","fetched_at":"2026-10-26T21:20:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}