APFS · CVE-2026-86910 · Infrastructure
FIX → 26.7 · 15.8
Apple's macOS Golden Gate 27 advisory fixes a permissions issue in the APFS file system that lets an app access files it should not reach. An attacker needs a malicious app already running on the Mac to read restricted files.
first public Sep 14, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any Mac that has not installed macOS Golden Gate 27 is exposed to a local app reaching restricted files through APFS. The advisory does not name a required configuration, so default installs appear affected. Macs already on Golden Gate 27 are fixed according to Apple's advisory.
Who cares apple, apple-silicon, intel-mac, macos, vendor-advisory
sw_vers -productVersion on the Mac and compare the result with 27 (macOS Golden Gate 27)Upgrade to 26.7 · 15.8
About the security content of macOS Golden Gate 27 - Apple Support
This document describes the security content of macOS Golden Gate 27.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released September 14, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: Processing a maliciously crafted image may lead to unexpected process termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-86882: Peter Malone
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: Processing a maliciously crafted image may lead to unexpected app termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
CVE-2026-86918: Arni Hardarson (Neonix Security)
Entry added October 19, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved data protection.
CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero, Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: A malicious application may be able to bypass Privacy preferences
Description: An authorization issue was addressed with improved state management.
CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, 이재영
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with additional entitlement checks.
CVE-2026-112446: Sindre Sorhus, LiangWei
Entry added October 26, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to disclose kernel memory
Description: This issue was addressed by removing the vulnerable code.
CVE-2026-86940: Dave G.
Entry added October 19, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An application may be able to access restricted files
Description: A permissions issue was addressed with improved path validation.
CVE-2026-86910: an anonymous researcher
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to cause unexpected system termination or write kernel memory
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-84523: Cem Onat Karagun, an anonymous researcher
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to cause unexpected system termination
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-65396: Bhaswanth Chigurupati
Entry added October 19, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to access sensitive user data
Description: A privacy issue was addressed with improved access restrictions.
CVE-2026-84582: Zhongcheng Li (CK01)
Entry added October 19, 2026
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: A local app may be able to read a persistent account identifier
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-86888: Zhongcheng Li (CK01)
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to access protected user data
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-84587: an anonymous researcher
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: A malicious application may be able to leak sensitive user information
Description: An information disclosure issue was addressed with improved state management.
CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)
Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023)
Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account
Description: An authentication issue was addressed with improved
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.