CVE-2026-113938: Input Validation

Published Oct 26, 2026
·
Updated

Accelerate Framework. An out-of-bounds write issue was addressed with improved bounds checking.

Other sources

Accounts. A logging issue was addressed with improved data redaction.

— Apple

Accounts. This issue was addressed with additional entitlement checks.

— Apple

AirPort. An authorization issue was addressed with improved state management.

— Apple

APFS. An out-of-bounds read was addressed with improved bounds checking.

— Apple

APFS. An out-of-bounds write issue was addressed with improved bounds checking.

— Apple

Credit

an anonymous researcher, Bhaswanth Chigurupati, LiangWei, Sindre Sorhus, Nguyen Duc Anh(Noventiq), Maher Azzouzi, 준우 이, Jonathan Bar Or@@yo_yo_yo_jbo, Bhuwan Bhetwal, Narendra Singh@@_3P1C, Jakob Pammer, Aswin Kumar Gokula Kannan, Thanatos Tian (HKPolyU) & wgg with Diffract, Marco Schmitt, Kwak kiyong@@Pwnkai23, Song nuri, Nathaniel Oh@@calysteon, Ruslan Dautov, Kwak Kiyong@@Pwnkai23, Song Nuri, Thomas Guillem, We Muftihaturrahmah, Peter Malone, Claudio Bozzato(Cisco Talos), Francesco Benvenuto(Cisco Talos), Jaeyeong Lee, Meta Red Team X - Nik Tsytsarkin, Josh Maine(Calif), Dohyeon An Technology Inc@@PILAB, Hcamael, 章鱼哥 (aipyaipy.com)@@aipy, Rahul Raj, @@Licht_jb, Chanwit Muenprakoddee (ChemIndy), Lance Cain - Senior Security Researcher at SpecterOps Inc., YingMuo@@YingMuo(DEVCORE Research Team), Paul Montgomery@@nullevent, lunar815, Surej Sekhar, Piotr Jerzy Duszynski, r3pwnx@@r3pwnx, Lily Cohl@@GenericCoding, Lakshay Sharma (MrW0r57), Abodi Dawoud, Marco Schmitt(Calif), Andrey Chernykh(Calif), Franco Belman at Blackwing Intelligence, Chris Bailey - Short Circuit, Pasquale Scola, Neon, Niels Hofmans, Mustafa Calap@@ordinal0, dbg.re), Ivan Fratric(Google Project Zero), Andreas Jaegersberger & Ro Achterberg(Nosebeard Labs), Mateusz Jurczyk(Google Project Zero), Tucker Willenborg, Frederick Kaludis (Coiffeur0x90)(Nosebeard Labs), DEVADATH V L, Junyeong Lee (jylab.github.io), Weeraphat Srisutham, Yejun Kim, Zwei Tasse Kaffee, an anonymous researcher(Calif), 章鱼哥 (aipyaipy.com)@@aipy(Calif), Roman Zabicki(Calif), Anna Groza@@pwnlambda(Calif), Meta Product Security, Përparim Mjeku, Altin Gashi, Substrate, Stefan Esser (Calif), 정우 하@@0xfa11babe, Jay K Patel, Jay J Patel, Jay Patel, Nurihan Kim (HanTul)(TrendAI Zero Day Initiative), Frederick Kaludis (Coiffeur0x90)(DBAppSecurity's WeBin lab), YingQi Shi@@Mas0nShi(DBAppSecurity's WeBin lab), Lakshay Sharma (MrW0r57)/WorstCase Labs.(Iru), Ashish Kavishwar(Iru), Csaba Fitzl@@theevilbit(Iru), Gergely Kalman@@gergely_kalman, Sanny Mitra, Alfredo Pesoli@@__rev(Bynar), Koh M. Nakagawa@@tsunek0h(FFRI Security Inc), Lyutoon, Andrey Chernykh (BypassLabs.ai), Keisuke Hosoda, R4mbb(Lupus Nova), Rodolphe BRUNETTI@@eisw0lf(Lupus Nova), D4rthL, Roman Zabicki(Talence Security), Tristan Madani@@TristanInSec(Talence Security), Christian Niel Angel(Protectiv IT Security Inc), powerprove(SecuRing), Wojciech Regula(SecuRing), R4mbb, Michael Benich, Seung Je Seong, Aswin Kumar Gokulakannan, Minseok Kim, Dave G., Thanatos Tian (HKPolyU) & wgg & xmr, Jihwan Yoon, Yash Pandya, Parth Raval, Garin R, Sattyam Yadav(Protectiv IT Security Inc), onetwo(Protectiv IT Security Inc), Robert Tran(Protectiv IT Security Inc), Merrick Hare(Protectiv IT Security Inc), @@pixiepointsec, sh3rlock (김보겸), Nik Tsytsarkin, PETOWORKS의 Bugeun Choi@@Bugeun(Google Project Zero), Rahul Raj(Google Project Zero), Piotr Jerzy Duszynski(Google Project Zero), Sihyun Roh (Compsec, SNU), Andrey Chernykh, Charles Stevenson, Mathis Mansière, Nord0x, Bhuwan Bhetwal(Braze Security Team), Kwak Kiyong@@Pwnkai23(Braze Security Team), Song Nuri(Braze Security Team), Nicolas Seriot(Braze Security Team), Tommy DeVoss@@thedawgyg(Braze Security Team), Navapon Premkasem, Richard Zana, Pedro Pinho, f0r(MurphySec), Wang Yu, Nebula Security@@nebusecurity(Aginor), Tim Michaud@@TimGMichaud(Aginor), Xinru Chi(Pangu Lab), Billy Jheng Bing Jhong(STAR Labs SG Pte), Pan Zhenpeng@@Peterpan0927(STAR Labs SG Pte), Wout van der Ploeg (woutvanderploeg.nl), John Lussier, Cem Onat Karagun, greenbynox, Marc Newlin(SkySafe), OpenAI, Arnold Cartagena(Tolmo), Matt Suiche@@msuiche(Tolmo), Will Estes, Jerry L. Knot, Yiğit Can YILMAZ@@yilmazcanyigit, Eliya M., Viacheslav Radiukov, Tristan Madani (Talence Security), Robert Tran, Vinay Kumar Rasala (Xplo8E)(Appknox), CVE-2026-112500, Daniel Rodríguez, Abodi Dawoud(Lupus Nova), Zhongquan Li@@Guluisacat(Positive Technologies), Ilya Andr (andrd3v)(Positive Technologies), Mahmoud Abdelmoniem, Musaab Khan@@bxff, Saoud Khalifah, stratan@@5tratan, ret2happy@@ret2happy, 진규정 (Gyujeong Jin(DEVCORE Research Team), @@G1uN4sh(DEVCORE Research Team), Lucas Parnell(DEVCORE Research Team), ret2happy@@ret2happy(DEVCORE Research Team), Meta Red Team X - Nik Tsytsarkin(DEVCORE Research Team), Md Rasel Bhuyan (www.linkedin.com/in/rasel-bhuyan), Aidan Hunt (forgechroma.com), Mickey Jin@@patch1t, Varik Matevosyan@@D4RK7ET, Prafull Dhiman, Alto_00000, Siddharth Aeri, Gabriel '0xv1n' Cardona, Mrunal Chawda, Kujtim Kryeziu (Sentry), 도현 김, YEONGJAE SHIN, Ithrael, OSORI(Iru), wdszzml(Iru), Atuin Automated Vulnerability Discovery Engine(Iru), JeongAhn Jang(sentry), Alto_00000(sentry), Nicolas Seriot(sentry), 김도현(sentry), Abodi Dawoud(sentry), Drin Raci(sentry), Jakob Pammer(Appknox), Stuart Wallace(Appknox), hamayanhamayan(Appknox), Ilya Andr (andrd3v), Hongsik Kim (mnur), ruitong@@abstract, Efstratios Kaplanellis@@5tratan(Almamater Technologies), 준우 이(Colorado Boulder), an anonymous researcher(Colorado Boulder), Ruitong (Abstract Lab(Colorado Boulder), University(Colorado Boulder), an anonymous researcher(Nosebeard Labs), 도현 김(Nosebeard Labs), Junyeong Lee (jylab.github.io)(Nosebeard Labs), Niels Hofmans(Nosebeard Labs), Jonghoon Han (Aegis), f4&Zhiniang Peng with HUST, Geonha Lee@@leegn4a, Arni Hardarson (Neonix Security), YUJUNG CHOI@@Dusker, koocolb, Alfredo Pesoli via Bynario Atlas (bynar.io)@@__rev, Robert Mindo, N.M.Praveen Nawarathne@@zblockrat, Stav Nir, Vladimir Tokarev, Richard Hyunho Im at Route Zero Security@@richeeta, cnitlrt@@abstract(Sentry), Roman Belovitskiy(Sentry), Lyutoon(Sentry), Art Pllana(Sentry), Redon Gashi(Sentry), Teodor Sorescu@@teodorsorescu, Eddy Tsalolikhin, lokerxx, Phillip Groves, cnitlrt@@abstract, Aditya Kumar, Lucas Lammer, Stuart Wallace, Albin Haliti, silo, Bhuwan Bhetwal(ThreatBook), Feng Xue(ThreatBook), XGPT(ThreatBook), Nathaniel Oh@@calysteon(Talence Security), an anonymous researcher(Talence Security), Narendra Singh@@_3P1C(Talence Security), Joshua Mason(Mandiant), zenith, Pan ZhenPeng@@Peterpan0927(STAR Labs SG Pte), Santiago Albertengo, Maher Azzouzi(Nosebeard Labs), Frederick Kaludis (Coiffeur0x90), Mufeed VH(Winfunc Research), Ryan Dowd@@_rdowd, Wesley Wineberg, 云开 江, Joshua Maina, Mahmoud Gamal@@Zombiehelp54, Thanatos Tian (HKPolyU) & wgg & 2st with Diffract, David Krehwinkel, Rotce(SkySafe), Sandeep Wawdane (thecybersandeep)(SkySafe), Ankur Saini(Volexity), Do Young Park (adawn), MYUNGYONG LEE, Luke Francis@@lukefr09, Shubham Chaskar, Kwak Kiyong, Avinash Kumar Thapa & Jay Kaushik Patel, Hossein Lotfi@@hosselot(TrendAI Zero Day Initiative), 은태 장, Franz Bettag, OpenAI Codex Security - Amy Burnett, Euntae Jang, pwn2addr, Gia Bui@@yabeow(Calif), Myungyong Lee, remanone@@remanone_, Josef Korbel (Citadelo), Charles Kern, Malik M.@@m411k_, Chris Rohlf with Anthropic Research, Drinor Selmanaj (Sentry), Luke Francis, Jackson Kuja, Ricardo Prado

Affected Software

1 affected componentFixes available
Apple macOS Golden Gate<27.2
27.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 27.2

Event History

Oct 26, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

Which platform is identified as affected?

The provided data identifies Apple macOS Golden Gate as the affected software.

2

What types of weaknesses are included in the reported issue?

The listed CWEs include input validation flaws, use-after-free issues, null pointer dereferences, buffer overflows, and race conditions.

3

Which components are specifically mentioned in the available description?

The available description mentions Accounts, AirPort, APFS, App Store, Apple Neural Engine, AppleAVD, AppleMobileFileIntegrity, and AppleRAID. The description is truncated, so this is not necessarily a complete component list.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203