Update macOS now: public exploit code turns Storage flaw CVE-2026-112487 into root

Timing: Apple shipped the fix on 26 October 2026. Public exploit code appeared on 31 October. We checked all facts on 1 November 2026 and publish the same day.

What happened

A macOS flaw lets an app that already runs on a Mac gain root privileges. It is tracked as CVE-2026-112487.

Apple lists it under the Storage component. Apple's wording: "A path handling issue was addressed with improved validation." The Impact line reads: "An app may be able to gain root privileges."

On 31 October a public proof of concept appeared on GitHub. Its author, Lyutoon, is one of the researchers Apple credits. The PoC author attributes the bug to the Document Revisions service (revisiond). Apple does not name that service.

Who is affected

Macs running these versions are affected:

• macOS Golden Gate: before 27.2
• macOS Tahoe: before 26.7.2
• macOS Sequoia: before 15.8.2

This is a local privilege escalation. The attacker first needs to run code on the Mac, as an app or a local user. It is a second-stage bug, used after initial access or through a malicious app.

What is confirmed

• The fix. macOS Golden Gate 27.2, Tahoe 26.7.2 and Sequoia 15.8.2, released on 26 October 2026.
• The impact. Apple says an app may gain root privileges.
• The credits. YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab, Junyeong Lee, Andreas Jaegersberger and Ro Achterberg of Nosebeard Labs, Jaeyeong Lee, Gergely Kalman, and Lyutoon.
• A public PoC. The repository holds a README, Objective-C source and a demo video. It claims a working root escalation on macOS 26.6 with SIP enabled. Our read-only review found no binaries or downloaders. ThreatWire has not executed it. We do not reprint any steps.
• Same release batch. The 26 October updates also fixed other root-class macOS bugs, such as CVE-2026-112545 (configd) and CVE-2026-113900 (Crash Reporter). We know of no public PoC for those.

What is not confirmed

• No CVSS score. NVD lists the CVE as Awaiting Analysis and has not scored it yet. Apple publishes no score.
• No severity from GitHub. Advisory GHSA-8fjw-hm3f-h763 is unreviewed, severity unknown.
• No exploitation in the wild. Apple makes no such statement.
• Not in CISA KEV. We checked catalog 2026.10.30 on 1 November.
• No independent reproduction. ThreatWire did not run the PoC.

What to do

1. Update macOS now to Golden Gate 27.2, Tahoe 26.7.2 or Sequoia 15.8.2, through Software Update. Apple ships the fix only in these versions.
2. Check your fleet. Find Macs still below those versions in your MDM. (ThreatWire advice.)
3. Limit untrusted apps. Until patched, any local app is a possible path to root. (ThreatWire advice.)

This is the second public root PoC for macOS we have covered in recent weeks. The first was the macOS autofs path traversal CVE-2026-84568.

Sources

Record: CVE-2026-112487.

Sources: Apple security notes 149521, 149522 and 149523, Apple security releases, NVD, CVE.org, GitHub Advisory Database and the CISA KEV catalog. Links are in the references list.