{"id":"CVE-2026-84539","kind":"vulnerability","aliases":["CVE-2026-84539"],"related":[],"title":"Apple macOS: out-of-bounds write can crash the system via an app","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination.","summary":"An out-of-bounds write flaw in an unspecified macOS component was fixed with better bounds checking. A malicious app may be able to force an unexpected system termination, which is a denial-of-service effect.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["fixed-macos-version"],"how_to_check":"- unknown","fix":"- Update macOS to Golden Gate 27 or macOS Tahoe 26.7.2 or later, per the advisory.","status":"open","published_at":"2026-10-26T21:20:05+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:16+00:00","updated_at":"2026-10-26T21:57:16+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:57:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to Golden Gate 27 or macOS Tahoe 26.7.2 or later, per the advisory.","reach":"local","title":"Apple macOS: out-of-bounds write can crash the system via an app","impact":"low","summary":"An out-of-bounds write flaw in an unspecified macOS component was fixed with better bounds checking. A malicious app may be able to force an unexpected system termination, which is a denial-of-service effect.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"A malicious app forces the system to terminate unexpectedly.","analyst_note":"Check Apple's security release notes for the affected component and the exact fixed build numbers.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["fixed-macos-version"],"who_is_affected":"Macs running macOS releases before the fixed builds. The sources do not name the affected component or any special configuration, so the exact exposure is unknown. Teams already on the fixed releases can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000539,"input_tokens":3270,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-84539':17A,20A '26.7.2':88C '27':85C 'abl':49B,93C 'address':72C 'app':14A,46B,90C 'appl':1A,22B 'apple-devic':21B 'better':41B 'bound':6A,30B,42B,68C,75C 'caus':95C 'check':43B,76C 'compon':37B 'crash':9A 'cve':15A,18A 'denial':60B 'denial-of-servic':59B 'devic':23B 'effect':63B 'fix':39B,80C 'flaw':32B 'forc':51B 'gate':84C 'golden':83C 'improv':74C 'infrastructur':24B 'issu':70C,78C 'maco':2A,25B,36B,82C,86C 'malici':45B 'may':47B,91C 'out-of-bound':3A,27B,65C 'servic':62B 'system':11A,54B,97C 'taho':87C 'termin':55B,98C 'unexpect':53B,96C 'unspecifi':35B 'via':12A 'write':7A,31B,69C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS releases before the fixed builds. The sources do not name the affected component or any special configuration, so the exact exposure is unknown. Teams already on the fixed releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84539","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84539","severity":null,"published_at":"2026-10-26T21:20:05+00:00","modified_at":"2026-10-26T21:20:05+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}