{"id":"CVE-2026-86915","kind":"vulnerability","aliases":["CVE-2026-86915"],"related":[],"title":"macOS: race condition lets an app crash the whole system","description":"A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27. An app may be able to cause unexpected system termination.","summary":"A race condition in macOS allowed a local app to trigger an unexpected system termination. Apple fixed it with improved locking in macOS Golden Gate 27.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple-devices","infrastructure","macos"],"not_affected_if":["already-on-macos-golden-gate-27"],"how_to_check":"- Check the macOS version under About This Mac or with `sw_vers -productVersion`; versions before macOS Golden Gate 27 are exposed.","fix":"- Update macOS to `Golden Gate 27` or later through Software Update.","status":"open","published_at":"2026-10-20T01:17:27+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:35:14+00:00","updated_at":"2026-10-25T04:35:14+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `Golden Gate 27` or later through Software Update.","reach":"local","title":"macOS: race condition lets an app crash the whole system","impact":"low","summary":"A race condition in macOS allowed a local app to trigger an unexpected system termination. Apple fixed it with improved locking in macOS Golden Gate 27.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple-devices"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Local app can crash the system, causing unexpected termination","analyst_note":"Check the Apple security notes for macOS Golden Gate 27 for affected releases and the exact CVE-2026-86915 entry, since the sources give only a one-line description.","how_to_check":"- Check the macOS version under About This Mac or with `sw_vers -productVersion`; versions before macOS Golden Gate 27 are exposed.","needs_analyst":true,"not_affected_if":["already-on-macos-golden-gate-27"],"who_is_affected":"Any Mac running a macOS release before Golden Gate 27 can be affected, since the flaw sits in the operating system itself. The sources do not say which earlier releases or hardware are involved, so treat any unpatched Mac as in scope and skip nothing on the basis of configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000571,"input_tokens":3243,"output_tokens":493,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86915':13A,16A '27':47B,64C 'abl':69C 'address':52C 'allow':27B 'app':6A,30B,66C 'appl':18B,37B 'apple-devic':17B 'caus':71C 'condit':3A,24B,50C 'crash':7A 'cve':11A,14A 'devic':19B 'fix':38B,59C 'gate':46B,63C 'golden':45B,62C 'improv':41B,54C 'infrastructur':20B 'issu':57C 'let':4A 'local':29B 'lock':42B,55C 'maco':1A,21B,26B,44B,61C 'may':67C 'race':2A,23B,49C 'system':10A,35B,73C 'termin':36B,74C 'trigger':32B 'unexpect':34B,72C 'whole':9A","nicknames":[],"mitigations":[],"who_affected":"Any Mac running a macOS release before Golden Gate 27 can be affected, since the flaw sits in the operating system itself. The sources do not say which earlier releases or hardware are involved, so treat any unpatched Mac as in scope and skip nothing on the basis of configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86915","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86915","severity":null,"published_at":"2026-10-20T01:17:27+00:00","modified_at":"2026-10-20T15:17:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}