CVE-2026-112487: Privilege Escalation on macOS

CVE-2026-112487 is a path handling vulnerability in macOS that allows an unprivileged app to perform a local privilege escalation (LPE) to root privileges. The flaw affects the revisiond process and was documented in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2, where it was fixed with improved path validation. Any application with limited privileges can exploit this issue to gain root access to the system.

The CVSS score is not reported in official data; however, local privilege escalation to root represents maximum impact. The vulnerability was patched by Apple in the indicated versions and is known to be resolved. A public signal exists on GitHub (October 31, 2026) of code claiming to contain exploits for this vulnerability; technical details are available to researchers and potentially adversaries. Social media (unverified) report the vulnerability was identified and exploited automatically.

Administrators of macOS environments must update systems immediately to patched versions: Golden Gate 27.2, Sequoia 15.8.2, or Tahoe 26.7.2. Verify the inventory of macOS devices in your organization and prioritize systems running vulnerable versions, particularly those used by users with access to sensitive data or critical infrastructure. Meanwhile, monitor system logs for anomalous behavior related to privilege escalation or unauthorized access to root processes.