CVE-2026-112544 in macOS
Summary
by MITRE • 10/26/2026
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a malicious disk image may cause unexpected system termination.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability described involves an out-of-bounds write condition within the macOS operating system, specifically affecting components responsible for handling disk images. Out-of-bounds writes are among the most critical memory corruption vulnerabilities because they allow an attacker to overwrite adjacent memory locations with arbitrary data. This flaw arises from insufficient validation of input parameters when processing mounted disk image files. The core technical failure lies in the lack of rigorous bounds checking during the parsing or mounting process, which permits a crafted payload to write beyond the allocated buffer boundaries into system memory structures that are not intended for modification by user-space applications.
The operational impact of this vulnerability is significant due to its potential for denial of service and possible code execution. As noted in the advisory, mounting a malicious disk image can cause unexpected system termination, which manifests as a kernel panic or immediate crash of critical system processes. This represents a reliable method for an attacker to disrupt availability on affected systems. However, beyond simple disruption, out-of-bounds writes often serve as a precursor to more severe exploits. By carefully crafting the overflow data, an attacker may be able to overwrite function pointers, return addresses, or security-critical flags in memory. This could potentially lead to arbitrary code execution with elevated privileges, depending on the specific context of the overwritten memory and the presence of other mitigations such as ASLR or DEP.
From a classification perspective, this vulnerability aligns closely with CWE-787: Out-of-bounds Write, which describes writing data outside the bounds of allocated memory. It also relates to CWE-20: Improper Input Validation, as the root cause is the failure to properly validate the size and content of the disk image before processing it. In terms of attack vectors, this falls under ATT&CK technique T1566.002: Phishing: Spearphishing Attachment or more broadly T1496: Resource Hijacking if used for denial of service, though the primary vector is local exploitation via physical access to a malicious disk image file. The requirement to mount the image suggests that an attacker needs either direct physical access to the machine or the ability to trick a user into mounting a specially crafted volume, which may involve social engineering tactics.
Mitigation strategies primarily rely on applying the software update provided by Apple in macOS Golden Gate 27.2, which implements improved bounds checking routines within the disk image handling subsystems. This patch ensures that any data written during the mount operation is strictly confined to its allocated memory space, thereby preventing the overflow condition. For organizations managing fleets of Mac devices, it is imperative to ensure rapid deployment of this update across all endpoints. Additionally, users should be educated on the risks associated with mounting disk images from untrusted sources. Implementing strict endpoint detection and response policies that monitor for unusual kernel-level activity or unexpected system terminations can help detect attempts to exploit this vulnerability in real-time before significant damage occurs. Regular security audits of external media handling protocols and enforcing least-privilege principles where possible further reduce the attack surface associated with removable storage devices.