--- id: "CVE-2026-84586" page: "https://infrastack.ai/live/CVE-2026-84586" kind: "vulnerability" aliases: ["CVE-2026-84586"] title: "An information disclosure issue was addressed with improved state management" severity: "medium" cvss: 5.5 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "macOS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-account", "macos", "vendor", "vendor-advisory"] not_affected_if: ["already-on-macos-golden-gate-27"] published_at: "2026-09-14T21:17:34+00:00" first_seen_at: "2026-11-10T00:16:53+00:00" updated_at: "2026-11-10T00:28:47+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149035", "first_seen_at": "2026-11-10T00:16:53+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/149037", "first_seen_at": "2026-11-10T00:17:03+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84586", "first_seen_at": "2026-11-10T00:28:47+00:00"}] exploit_sources: [] --- # An information disclosure issue was addressed with improved state management Link for people: https://infrastack.ai/live/CVE-2026-84586 (this .md is for agents) Apple's macOS Golden Gate 27 security notes describe an information disclosure flaw in the Apple Account component. A malicious app on the Mac may be able to leak sensitive user information. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:macOS affected range not listed fixed no fixed version listed - vendor:apple macos affected < 27.0 fixed 27.0 - vendor:apple watchos affected < 27.0 fixed 27.0 ## How to check - Check the installed macOS version with `sw_vers -productVersion`; a version below macOS Golden Gate 27 is exposed. - Confirm the Mac is one of the listed models (MacBook Neo (2026), MacBook Air, MacBook Pro, iMac, Mac mini, Mac Studio, Mac Pro with Apple silicon). ## Fix - macOS: update to macOS Golden Gate 27 (released September 14, 2026). ## Timeline - 2026-11-10T00:16:53+00:00 lab https://support.apple.com/en-us/149035 — Apple: About the security content of macOS Golden Gate 27 - Apple Support - 2026-11-10T00:17:03+00:00 lab https://support.apple.com/en-us/149037 — Apple: About the security content of watchOS 27 - Apple Support - 2026-11-10T00:28:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-84586 ## Documents - [advisory] Apple: About the security content of macOS Golden Gate 27 - Apple Support https://support.apple.com/en-us/149035 - [advisory] Apple: About the security content of watchOS 27 - Apple Support https://support.apple.com/en-us/149037 - [mentions] Apple: About the security content of macOS Golden Gate 27 - Apple Support https://support.apple.com/en-us/149035 - [mentions] Apple: About the security content of watchOS 27 - Apple Support https://support.apple.com/en-us/149037 ## From the sources About the security content of macOS Golden Gate 27 - Apple Support # About the security content of macOS Golden Gate 27 This document describes the security content of macOS Golden Gate 27. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Golden Gate 27 Released September 14, 2026 ### Accelerate Framework Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone ### Accelerate Framework Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: Processing a maliciously crafted image may lead to unexpected app termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86918: Arni Hardarson (Neonix Security) Entry added October 19, 2026 ### Accessibility Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero, Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433) ### Accounts Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, 이재영 ### Accounts Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: This issue was addressed with additional entitlement checks. CVE-2026-112446: Sindre Sorhus, LiangWei Entry added October 26, 2026 ### afpfs Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to disclose kernel memory Description: This issue was addressed by removing the vulnerable code. CVE-2026-86940: Dave G. Entry added October 19, 2026 ### APFS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An application may be able to access restricted files Description: A permissions issue was addressed with improved path validation. CVE-2026-86910: an anonymous researcher ### APFS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher ### APFS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to cause unexpected system termination Description: A buffer overflow was addressed with improved size validation. CVE-2026-65396: Bhaswanth Chigurupati Entry added October 19, 2026 ### App Intents Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: A privacy issue was addressed with improved access restrictions. CVE-2026-84582: Zhongcheng Li (CK01) Entry added October 19, 2026 ### App Store Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-86888: Zhongcheng Li (CK01) ### AppKit Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-84587: an anonymous researcher ### Apple Account Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A malicious application may be able to leak sensitive user information Description: An information disclosure issue was addressed with improved state management. CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01) ### Apple Account Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account Description: An authentication issue was addressed with improved --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_