CVE-2026-112473 in macOS
Summary
by MITRE • 10/26/2026
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An attacker with the legacy VNC password for Screen Sharing may be able to copy files to the Mac.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described constitutes a critical authorization bypass within Apple's operating system environment, specifically affecting versions of macOS prior to Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2. The root cause lies in flawed state management mechanisms associated with the legacy Virtual Network Computing protocol implementation used for Screen Sharing. While modern iterations of Apple's remote access solutions have moved toward more secure authentication methods such as two-factor authentication or device-specific pairing codes, this specific flaw persists in systems that retain support for older VNC password-based authentication schemes. The issue arises because the internal state machine governing session validity and permission checks fails to properly enforce boundaries between authenticated actions and unauthorized file system operations when legacy credentials are utilized.
From a technical perspective, the defect allows an attacker who possesses valid legacy VNC credentials to escalate their privileges beyond what is intended for standard remote desktop sessions. Typically, Screen Sharing permissions grant access to display output and limited input control but do not inherently permit unrestricted read or write access to arbitrary files on the host system due to sandboxing and permission models inherent in macOS. However, this state management error creates a condition where the application fails to correctly validate file operation requests against the user's actual privileges during active VNC sessions. This misalignment enables an attacker to execute copy operations that bypass standard security controls, effectively allowing them to exfiltrate sensitive data from the compromised Mac system without triggering typical alerting mechanisms associated with unauthorized access attempts.
The operational impact of this vulnerability is significant for organizations and individuals relying on legacy remote management tools. An adversary who has obtained or guessed a weak VNC password can leverage this flaw to silently copy confidential documents, configuration files, or personal data from the target machine. This capability transforms what might otherwise be viewed as a low-severity display-only access issue into a high-risk data exfiltration vector. The ability to copy files implies that attackers could potentially stage further attacks by extracting credentials stored in keychains, copying SSH keys for lateral movement within a network, or stealing intellectual property and personally identifiable information. Given the nature of VNC being often used over networks, this vulnerability also poses risks if Screen Sharing is enabled on devices connected to untrusted networks or exposed via port forwarding without additional protective layers such as firewalls or VPNs.
Mitigation strategies must prioritize immediate remediation through software updates alongside configuration hardening. The primary defense is to apply the latest security patches provided by Apple, which resolve the state management logic errors in macOS Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2. For environments where upgrading may not be immediately feasible due to compatibility constraints with legacy applications, administrators should disable Screen Sharing entirely if it is not required for business operations. If remote access remains necessary, organizations must enforce the use of modern authentication methods that do not rely on static VNC passwords. This includes configuring macOS to require two-factor authentication or using device-specific pairing codes which are cryptographically bound and significantly more resistant to brute-force attacks than traditional password schemes.
Furthermore, network-level controls should be implemented to restrict access to Screen Sharing services exclusively from trusted IP ranges or through secure tunnels such as Virtual Private Networks. This reduces the attack surface by preventing unauthorized entities from even reaching the vulnerable service endpoint. Security monitoring solutions should also be configured to detect anomalous file system activity originating from VNC processes, providing an additional layer of defense-in-depth against exploitation attempts that might evade patching cycles. By combining timely updates with strict access controls and modern authentication protocols, organizations can effectively neutralize this authorization bypass vulnerability and protect their systems from unauthorized data exfiltration. This incident underscores the importance of regularly auditing legacy protocol usage and ensuring that state management logic in remote administration tools adheres to strict least-privilege principles aligned with industry standards such as CWE-269 for improper privilege assignment and ATT&CK techniques related to remote access tooling and data staging.