Medium severity4.8NVD Advisory· Published Oct 26, 2026· Updated Oct 26, 2026

CVE-2026-112556

Description

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker may tamper with code-signed applications to execute arbitrary code in the application's context.

Affected products

Apple Inc./macOS Golden Gatellm-fuzzy
Range: before 27.2
Apple Inc./macOS Sequoiallm-fuzzy
Range: before 15.8.2
Apple Inc./macOS Tahoellm-fuzzy
Range: before 26.7.2

Patches

Vulnerability mechanics

References

support.apple.com/en-us/149521nvd
support.apple.com/en-us/149522nvd
support.apple.com/en-us/149523nvd

News mentions

Apple Patches for October 2026, (Mon, Oct 26th)
SANS Internet Storm Center · Oct 26, 2026

cvss	0.312
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000