PoC released for macOS flaw granting root; Apple has fixed
A proof of concept has been released for CVE-2026-112487, a path handling flaw in macOS that may allow an app to gain root privileges. Apple fixed the issue with improved validation in macOS Golden Gate 27.2, Sequoia 15.8.2, and Tahoe 26.7.2. Update the operating system on company Macs.
What happened
A proof of concept has been released for a macOS flaw that may allow an app to gain root privileges, the highest level of system access. Apple has already shipped a fix in current versions of the operating system.
Why it matters
With this flaw, a malicious app installed on a Mac may gain full control of the machine, with access to any data and system setting. Companies running outdated Macs are exposed if a user installs compromised software.
What to do
Update macOS to Golden Gate 27.2, Sequoia 15.8.2, or Tahoe 26.7.2, depending on the version in use. Identify how many Macs run earlier versions and prioritize their update.
For the technical team
- CVE
- CVE-2026-112487
- Affected
- Apple macOS (tratamento de caminhos) · Apple macOS. The source does not list affected versions, only fixed versions.
- Exploitation
- PoC/exploit released, reported by @ptdbugs (PT-2026-125183). The sources cite no exploitation in real attacks and no KEV listing.
- Fix
- macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2, via improved path validation, per Apple.
- Vector
- Path handling flaw in macOS (CVE-2026-112487). Per Apple, an app may be able to gain root privileges; the starting point is an app already running on the system, with no remote access mentioned in the source.
- More details
- Description attributed to Apple: path handling issue addressed with improved validation. ptdbugs report ID: PT-2026-125183. No disclosure date given in the source.
Timeline
Incident opened.
Sources 1 source
- @ptdbugs @ptdbugs
