{"id":"CVE-2026-84590","kind":"vulnerability","aliases":["CVE-2026-84590"],"related":[],"title":"Apple macOS: out-of-bounds write lets a remote attacker corrupt heap memory","description":"An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination or heap corruption.","summary":"An out-of-bounds write in an unspecified macOS component can crash an app or corrupt heap memory. Apple says a remote attacker may be able to trigger it, and the description does not say what code path is involved.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":[],"how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions.\n- Check the macOS build against the fixed releases: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2.","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), whichever matches the installed major release.","status":"open","published_at":"2026-10-26T21:20:13+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","triaged_at":"2026-10-26T21:57:13+00:00","updated_at":"2026-10-26T21:57:13+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:57:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia) or `26.7.2` (Tahoe), whichever matches the installed major release.","reach":"unknown","title":"Apple macOS: out-of-bounds write lets a remote attacker corrupt heap memory","impact":"high","summary":"An out-of-bounds write in an unspecified macOS component can crash an app or corrupt heap memory. Apple says a remote attacker may be able to trigger it, and the description does not say what code path is involved.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Remote attacker may corrupt heap memory or crash apps","analyst_note":"Check Apple's security release notes for the affected component and whether user interaction or a specific service is needed.","how_to_check":"- Run `sw_vers -productVersion` on each Mac and compare against the fixed versions.\n- Check the macOS build against the fixed releases: macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown. The sources name only macOS releases and do not identify the vulnerable component or the remote input that triggers the flaw. Any Mac on an unpatched release should be updated, and the advisory should be checked for narrower scope.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000605,"input_tokens":3297,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-84590':17A,20A '15.8.2':91C '26.7.2':94C '27.2':88C 'abl':52B,100C 'address':75C 'app':40B,104C 'appl':1A,22B,45B 'apple-devic':21B 'attack':11A,49B,97C 'bound':6A,30B,71C,78C 'caus':102C 'check':79C 'code':63B 'compon':36B 'corrupt':12A,42B,108C 'crash':38B 'cve':15A,18A 'descript':58B 'devic':23B 'fix':83C 'gate':87C 'golden':86C 'heap':13A,43B,107C 'improv':77C 'infrastructur':24B 'involv':66B 'issu':73C,81C 'let':8A 'maco':2A,25B,35B,85C,89C,92C 'may':50B,98C 'memori':14A,44B 'out-of-bound':3A,27B,68C 'path':64B 'remot':10A,48B,96C 'say':46B,61B 'sequoia':90C 'taho':93C 'termin':105C 'trigger':54B 'unexpect':103C 'unspecifi':34B 'write':7A,31B,72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:20:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84590","severity":null,"published_at":"2026-10-26T21:20:13+00:00","modified_at":"2026-10-26T21:20:13+00:00","first_seen_at":"2026-10-26T21:55:21+00:00","fetched_at":"2026-10-26T21:55:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}