GCVE-1988-2026-0393

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
Title
APPLE-SA-09-14-2026-3 macOS Golden Gate 27
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-09-14-2026-3 macOS Golden Gate 27 macOS Golden Gate 27 addresses the following issues. Information about the security content is also available at https://support.apple.com/149035. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Accelerate Framework Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: Processing a maliciously crafted image may lead to unexpected process termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-86882: Peter Malone Accessibility Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved data protection. CVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of Totally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero, Asaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433) Accounts Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, 이재영 APFS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An application may be able to access restricted files Description: A permissions issue was addressed with improved path validation. CVE-2026-86910: an anonymous researcher APFS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to cause unexpected system termination or write kernel memory Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84523: Cem Onat Karagun, an anonymous researcher App Store Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-86888: Zhongcheng Li (CK01) AppKit Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access protected user data Description: A permissions issue was addressed with additional restrictions. CVE-2026-84587: an anonymous researcher Apple Account Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A malicious application may be able to leak sensitive user information Description: An information disclosure issue was addressed with improved state management. CVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01) Apple Account Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account Description: An authentication issue was addressed with improved state management. CVE-2026-20683: Dem0ns (@天府简易信工作室), Abdelhak Kherroubi, Jasminder Pal Singh, Lehan Dilusha Jayasingha (Sri Lanka) Apple Intelligence Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to bypass Apple Intelligence security prompts Description: A permissions issue was addressed with improved state management. CVE-2026-84601: Nick Cook, Sentry Flag Apple Neural Engine Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to cause unexpected system termination Description: An integer overflow was addressed with improved input validation. CVE-2026-65408: tamdao AppleAVD Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence AppleDouble Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: Mounting a disk image with maliciously crafted files may lead to unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-84519: Richard Zana AppleFDEKeyStore Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A local attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved size validation. CVE-2026-84520: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. AppleMobileFileIntegrity Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A malicious app may be able to break out of its sandbox Description: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. CVE-2026-65381: Mickey Jin (@patch1t) Archive Utility Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to break out of its sandbox Description: This issue was addressed with improved handling of symlinks. CVE-2026-84584: Mickey Jin (@patch1t) Archive Utility Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: A race condition was addressed with improved state management. CVE-2026-84522: Mickey Jin (@patch1t) ATS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access user-sensitive data Description: A logging issue was addressed with improved data redaction. CVE-2026-84525: D4rthL ATS Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to access sensitive user data Description: A permissions issue was addressed with improved validation. CVE-2026-65342: Ahmed Alwardani, Mohamad Dawoud / Abodi Dawoud Authentication Services Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to delete credentials stored in Keychain Description: This issue was addressed by removing the vulnerable code. CVE-2026-86905: Ilya Andr (andrd3v) AuthKit Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: A local app may be able to read a persistent account identifier Description: A permissions issue was addressed with additional restrictions. CVE-2026-84583: Zhongcheng Li from IES Red Team autofs Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An app may be able to bypass Gatekeeper checks Description: A logic issue was addressed with improved checks. CVE-2026-84570: Mr.Gedik (@h4ck2s3c) autofs Available for: MacBook Neo (2026), MacBook Air with Apple silicon (2020 and later), MacBook Pro with Apple silicon (2020 and later), iMac with Apple silicon (2021 and later), Mac mini with Apple silicon (2020 and later), Mac Studio (2022 and later), and Mac Pro with Apple silicon (2023) Impact: An attacker with control of a network d
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown macOS Golden Gate Affected: unknown
guessed Create a notification for this product.
Credits
Apple Product Security via Fulldisclosure
Relationships
reference GCVE-1988-2026-0393 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "macOS Golden Gate",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-3 macOS Golden Gate 27\n\nmacOS Golden Gate 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149035.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nAccelerate Framework\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: Processing a maliciously crafted image may lead to unexpected\nprocess termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-86882: Peter Malone\n\nAccessibility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: This issue was addressed with improved data protection.\nCVE-2026-43664: Stuart Wallace, Ilya Andr (andrd3v), Rosyna Keller of\nTotally Not Malicious Software, CJ Vana, David Strnadel, Daniel Febrero,\nAsaf Cohen, Gongyu Ma (@Mezone0), Jian Lee (@speedyfriend433)\n\nAccounts\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious application may be able to bypass Privacy\npreferences\nDescription: An authorization issue was addressed with improved state\nmanagement.\nCVE-2026-65404: Arni Hardarson (Neonix Security), Vinay Kumar Rasala\n(Xplo8E) from Appknox, Stuart Wallace, \uc774\uc7ac\uc601\n\nAPFS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An application may be able to access restricted files\nDescription: A permissions issue was addressed with improved path\nvalidation.\nCVE-2026-86910: an anonymous researcher\n\nAPFS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination or\nwrite kernel memory\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84523: Cem Onat Karagun, an anonymous researcher\n\nApp Store\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-86888: Zhongcheng Li (CK01)\n\nAppKit\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access protected user data\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84587: an anonymous researcher\n\nApple Account\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious application may be able to leak sensitive user\ninformation\nDescription: An information disclosure issue was addressed with improved\nstate management.\nCVE-2026-84586: Prashan Samarathunge, Zhongcheng Li (CK01)\n\nApple Account\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to use the Sign In With Apple authentication\nflow to access the user\u0027s Apple Account\nDescription: An authentication issue was addressed with improved state\nmanagement.\nCVE-2026-20683: Dem0ns (@\u5929\u5e9c\u7b80\u6613\u4fe1\u5de5\u4f5c\u5ba4), Abdelhak Kherroubi, Jasminder Pal\nSingh, Lehan Dilusha Jayasingha (Sri Lanka)\n\nApple Intelligence\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to bypass Apple Intelligence security prompts\nDescription: A permissions issue was addressed with improved state\nmanagement.\nCVE-2026-84601: Nick Cook, Sentry Flag\n\nApple Neural Engine\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination\nDescription: An integer overflow was addressed with improved input\nvalidation.\nCVE-2026-65408: tamdao\n\nAppleAVD\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to cause unexpected system termination\nDescription: A use after free issue was addressed with improved memory\nmanagement.\nCVE-2026-65407: Franco Belman at Blackwing Intelligence\n\nAppleDouble\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: Mounting a disk image with maliciously crafted files may lead to\nunexpected system termination\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking.\nCVE-2026-84519: Richard Zana\n\nAppleFDEKeyStore\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local attacker may be able to cause unexpected system\ntermination or corrupt kernel memory\nDescription: A buffer overflow was addressed with improved size\nvalidation.\nCVE-2026-84520: Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927)\nof STAR Labs SG Pte. Ltd.\n\nAppleMobileFileIntegrity\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A malicious app may be able to break out of its sandbox\nDescription: A validation issue existed in the entitlement verification.\nThis issue was addressed with improved validation of the process\nentitlement.\nCVE-2026-65381: Mickey Jin (@patch1t)\n\nArchive Utility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to break out of its sandbox\nDescription: This issue was addressed with improved handling of\nsymlinks.\nCVE-2026-84584: Mickey Jin (@patch1t)\n\nArchive Utility\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: A race condition was addressed with improved state\nmanagement.\nCVE-2026-84522: Mickey Jin (@patch1t)\n\nATS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access user-sensitive data\nDescription: A logging issue was addressed with improved data redaction.\nCVE-2026-84525: D4rthL\n\nATS\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to access sensitive user data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65342: Ahmed Alwardani, Mohamad Dawoud / Abodi Dawoud\n\nAuthentication Services\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to delete credentials stored in Keychain\nDescription: This issue was addressed by removing the vulnerable code.\nCVE-2026-86905: Ilya Andr (andrd3v)\n\nAuthKit\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: A local app may be able to read a persistent account identifier\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-84583: Zhongcheng Li from IES Red Team\n\nautofs\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An app may be able to bypass Gatekeeper checks\nDescription: A logic issue was addressed with improved checks.\nCVE-2026-84570: Mr.Gedik (@h4ck2s3c)\n\nautofs\nAvailable for: MacBook Neo (2026), MacBook Air with Apple silicon (2020\nand later), MacBook Pro with Apple silicon (2020 and later), iMac with\nApple silicon (2021 and later), Mac mini with Apple silicon (2020 and\nlater), Mac Studio (2022 and later), and Mac Pro with Apple silicon\n(2023)\nImpact: An attacker with control of a network d"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:29Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/55"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/55"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149035"
        },
        {
          "url": "https://support.apple.com/downloads/"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/55"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-14-2026-3 macOS Golden Gate 27",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2022-3437",
              "type": "related"
            },
            {
              "destId": "CVE-2026-20683",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28899",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28934",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28937",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28966",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28968",
              "type": "related"
            },
            {
              "destId": "CVE-2026-28969",
              "type": "related"
            },
            {
              "destId": "CVE-2026-34979",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43664",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43677",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43683",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43684",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43686",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43687",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43688",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43689",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43690",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43691",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43692",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43695",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43696",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43697",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43698",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43719",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43737",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43738",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43741",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43785",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43786",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43787",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43788",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43789",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43790",
              "type": "related"
            },
            {
              "destId": "CVE-2026-43791",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64712",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64714",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64718",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64752",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64753",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64756",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64760",
              "type": "related"
            },
            {
              "destId": "CVE-2026-64790",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65342",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65344",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65345",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65348",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65354",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65358",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65359",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65360",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65361",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65362",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65364",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65365",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65369",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65374",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65375",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65376",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65377",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65378",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65380",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65381",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65382",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65383",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65393",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65395",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65398",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65399",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65400",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65401",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65402",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65403",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65404",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65405",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65406",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65407",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65408",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65409",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65410",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65412",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65413",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65414",
              "type": "related"
            },
            {
              "destId": "CVE-2026-65415",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84487",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84489",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84491",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84492",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84497",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84505",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84506",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84507",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84509",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84510",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84511",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84512",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84513",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84514",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84515",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84516",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84517",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84518",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84519",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84520",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84521",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84522",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84523",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84524",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84525",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84526",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84527",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84530",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84531",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84532",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84533",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84534",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84535",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84536",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84537",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84538",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84540",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84541",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84543",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84544",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84546",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84548",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84549",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84550",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84551",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84552",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84553",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84554",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84555",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84556",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84558",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84559",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84560",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84561",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84563",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84564",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84565",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84566",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84567",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84568",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84569",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84570",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84571",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84572",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84573",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84574",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84575",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84576",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84577",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84578",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84580",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84581",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84583",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84584",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84585",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84586",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84587",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84588",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84589",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84596",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84597",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84600",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84601",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84602",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84606",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84607",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84609",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84611",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84612",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84616",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84617",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84618",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84619",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84620",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84621",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84622",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84624",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84625",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84626",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84628",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84630",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84631",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84632",
              "type": "related"
            },
            {
              "destId": "CVE-2026-84635",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86869",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86870",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86876",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86881",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86882",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86884",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86888",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86889",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86891",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86894",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86897",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86898",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86900",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86901",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86902",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86903",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86905",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86909",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86910",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86911",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86917",
              "type": "related"
            },
            {
              "destId": "CVE-2026-86924",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0393",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/55",
            "automated": true,
            "contentSha256": "a7e77eb5c76891a79feeb3673564a3af37b299a1d06d6e29f4c94f1b1f7e40ce",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/55",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-14T22:06:19Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0393"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:29Z",
    "dateUpdated": "2026-10-02T04:57:29Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0393"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.