CVE-2026-112541

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.apple.com/en-us/149521	Vendor Advisory
https://support.apple.com/en-us/149522	Vendor Advisory
https://support.apple.com/en-us/149523	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::

History

06 Nov 2026, 13:40

Type	Values Removed	Values Added
First Time		Apple Apple macos
CPE		cpe:2.3:o:apple:macos::::::::
References	~~() https://support.apple.com/en-us/149521 -~~	() https://support.apple.com/en-us/149521 - Vendor Advisory
References	~~() https://support.apple.com/en-us/149522 -~~	() https://support.apple.com/en-us/149522 - Vendor Advisory
References	~~() https://support.apple.com/en-us/149523 -~~	() https://support.apple.com/en-us/149523 - Vendor Advisory

03 Nov 2026, 15:17

Type	Values Removed	Values Added
CWE		CWE-693
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.8

26 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-26 21:17

Updated : 2026-11-06 13:40

NVD link : CVE-2026-112541

Mitre link : CVE-2026-112541

CVE.ORG link : CVE-2026-112541

JSON object : View

Products Affected

apple

macos

CWE

CWE-693

Protection Mechanism Failure

{"id": "CVE-2026-112541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-112541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0", "lessThan": "15.8.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "26.7.2", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "27.2", "versionType": "custom"}]}]}], "published": "2026-10-26T21:17:46.883", "references": [{"url": "https://support.apple.com/en-us/149521", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149522", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/en-us/149523", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges."}], "lastModified": "2026-11-06T13:40:09.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "855F5ECD-CA54-4DB4-8AD6-86383177270D", "versionEndExcluding": "15.8.2", "versionStartIncluding": "15.0"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C07128F2-DA38-4B58-B8F5-5F1DA299EE2C", "versionEndExcluding": "26.7.2", "versionStartIncluding": "26.0"}, {"criteria": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12846F95-3F15-4909-9FD2-591AA176A6F0", "versionEndExcluding": "27.2", "versionStartIncluding": "27.0"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}