CVE-2026-112487

CVE-2026-112487 is listed under the Storage component in Apple's security notes for macOS Golden Gate 27.2, macOS Tahoe 26.7.2 and macOS Sequoia 15.8.2. All three were released on 26 October 2026.

Apple's Impact line says an app may be able to gain root privileges. The Description says a path handling issue was addressed with improved validation.

Apple credits YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Junyeong Lee, Andreas Jaegersberger and Ro Achterberg of Nosebeard Labs, Jaeyeong Lee, Gergely Kalman, and Lyutoon.

Score: Apple did not publish a CVSS score. NVD lists the CVE as Awaiting Analysis and has not scored it yet. The GitHub advisory GHSA-8fjw-hm3f-h763 is unreviewed, with severity unknown.

Attacker model: this is a local privilege escalation. The attacker first needs to run code on the Mac as a local app or user. It matters as a second stage, after initial access or a malicious app.

Same releases: the 26 October updates also fixed other root-class macOS bugs, for example CVE-2026-112545 in configd and CVE-2026-113900 in Crash Reporter. This record covers only CVE-2026-112487.

PoC status: a public GitHub repository from Lyutoon, one of the credited researchers, appeared on 31 October 2026. The PoC author attributes the bug to the Document Revisions service (revisiond). The repository claims a working local privilege escalation on macOS 26.6 with SIP enabled. ThreatWire reviewed it read-only and found no binaries or downloaders. ThreatWire has not executed it. We do not reprint any steps.

The CVE is not in the CISA KEV catalog (catalog 2026.10.30). Apple does not say it was exploited in the wild. Facts checked on 1 November 2026.

What to do: update to macOS Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2. Apple ships the fix only in those versions. Our explainer covers the details. See also the earlier macOS autofs root flaw CVE-2026-84568.