{"id":"CVE-2026-84542","kind":"vulnerability","aliases":["CVE-2026-84542"],"related":[],"title":"macOS: an app can read files outside its sandbox","description":"An access issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read files outside of its sandbox.","summary":"Apple macOS has an access control flaw that lets an app read files outside its sandbox. An attacker who gets a malicious or compromised app running on the Mac can read user files the app should not reach.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":["patched-macos"],"how_to_check":"- Check the macOS version with `sw_vers`, then compare it to the fixed builds named in the sources.\n- unknown","fix":"- Update macOS to `27` (macOS Golden Gate), `15.8.2` (macOS Sequoia), or `26.7.2` (macOS Tahoe), or later.","status":"open","published_at":"2026-10-26T21:20:06+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:15+00:00","updated_at":"2026-10-26T21:57:15+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:57:15Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27` (macOS Golden Gate), `15.8.2` (macOS Sequoia), or `26.7.2` (macOS Tahoe), or later.","reach":"local","title":"macOS: an app can read files outside its sandbox","impact":"medium","summary":"Apple macOS has an access control flaw that lets an app read files outside its sandbox. An attacker who gets a malicious or compromised app running on the Mac can read user files the app should not reach.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Sandboxed app reads user files outside its sandbox boundary","analyst_note":"Check the Apple security release notes for CVE-2026-84542 to confirm affected versions, prerequisites and whether user interaction is needed.","how_to_check":"- Check the macOS version with `sw_vers`, then compare it to the fixed builds named in the sources.\n- unknown","needs_analyst":true,"not_affected_if":["patched-macos"],"who_is_affected":"Any Mac running a macOS version older than the fixed releases named in the sources is affected. The sources do not say which earlier builds are vulnerable beyond that, or whether a specific app or configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000571,"input_tokens":3272,"output_tokens":487,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-84542':12A,15A '15.8.2':77C '26.7.2':80C '27':74C 'abl':85C 'access':23B,58C,64C 'address':61C 'app':3A,29B,43B,53B,82C 'appl':19B 'attack':36B 'compromis':42B 'control':24B 'cve':10A,13A 'endpoint':16B 'file':6A,31B,51B,88C 'fix':69C 'flaw':25B 'gate':73C 'get':38B 'golden':72C 'improv':63C 'infrastructur':17B 'issu':59C,67C 'let':27B 'mac':47B 'maco':1A,18B,20B,71C,75C,78C 'malici':40B 'may':83C 'outsid':7A,32B,89C 'reach':56B 'read':5A,30B,49B,87C 'restrict':65C 'run':44B 'sandbox':9A,34B,92C 'sequoia':76C 'taho':79C 'user':50B","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS version older than the fixed releases named in the sources is affected. The sources do not say which earlier builds are vulnerable beyond that, or whether a specific app or configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84542","severity":null,"published_at":"2026-10-26T21:20:06+00:00","modified_at":"2026-10-26T21:20:06+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}