Executive brief
macOS components (Accelerate Framework and APFS file system) contain memory handling flaws that could allow malicious apps or specially crafted files to crash the system or corrupt kernel memory. An attacker could exploit these vulnerabilities to cause denial of service or potentially gain higher system privileges through kernel-level memory manipulation.
Technical details
The vulnerability encompasses out-of-bounds write issues in the Accelerate Framework and APFS components of macOS. The Accelerate Framework flaw occurs when processing maliciously crafted images, while APFS contains an out-of-bounds write that can be triggered by an app already running on the system. Both issues were addressed with improved bounds checking and memory handling. The attack vector is local (requires an app to run or a malicious file to be processed), and exploitation could lead to unexpected process termination or kernel memory corruption. Patches are available in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: patched: Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7
- 2026-09-14: disclosed