CVE-2026-65379: macOS Information Disclosure Vulnerability

CVE-2026-65379 Overview

CVE-2026-65379 is an information disclosure vulnerability in Apple macOS stemming from improper handling of secure input state. A local application can exploit this flaw to access sensitive user data that should remain protected by the operating system's secure input mechanisms. Apple addressed the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor) and requires local access with low privileges to exploit.

Critical Impact
A locally installed application can bypass secure input protections to read sensitive user data, including potentially credentials or other confidential inputs handled by the system.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-10-20 - CVE-2026-65379 published to NVD
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-65379

Vulnerability Analysis

The vulnerability resides in the macOS secure input state handling logic. Secure input mode is a system facility that prevents applications and system components from observing keystrokes destined for password fields or other sensitive input contexts. When this state is mishandled, an unprivileged local application can observe or retrieve data that would normally be shielded from inspection.

Apple's advisory describes the fix as improved handling of the secure input state, indicating the root issue was logic that failed to consistently enforce the secure input boundary. Exploitation requires the attacker to run code locally on the target machine under a standard user context. No user interaction is required beyond the attacker's own process execution.

The impact is limited to confidentiality. Integrity and availability of the system are not affected, but the exposed data can include high-value secrets typed by the user while secure input was expected to be active.

Root Cause

The root cause is improper state management of the macOS secure input facility. The operating system did not consistently restrict access to protected input data under certain conditions, allowing an application to read information meant to be isolated. The CWE-200 classification confirms the issue is an unintended exposure of sensitive information rather than a memory safety or code execution flaw.

Attack Vector

The attack vector is local. An adversary must first achieve code execution on the target macOS system, typically through a malicious application, a trojanized installer, or a prior foothold obtained via phishing or supply chain compromise. Once running, the malicious application queries or interacts with the secure input subsystem to retrieve data that should be inaccessible to it.

No authentication beyond standard user privileges is required, and no user interaction is needed at the moment of exploitation. See the Apple Security Advisory 149035, Apple Security Advisory 149042, and Apple Security Advisory 149043 for vendor-provided technical context.

Detection Methods for CVE-2026-65379

Indicators of Compromise

Unexpected or unsigned applications querying input-related APIs or holding references to secure input state objects.
Processes launched from user-writable directories (/Users/*/Downloads, /tmp) that read keyboard or input event data shortly after launch.
Credential reuse or account compromise events on accounts whose owners work on unpatched macOS endpoints.

Detection Strategies

Monitor macOS endpoint telemetry for processes that interact with input-related frameworks or request accessibility and input monitoring entitlements without clear business justification.
Baseline normal application behavior and alert on new or unsigned binaries attempting to observe keyboard input shortly after installation.
Correlate suspicious process execution events with subsequent anomalous authentication activity to identify credential capture attempts.

Monitoring Recommendations

Track the macOS build and version across all managed endpoints to confirm patch coverage for Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
Audit applications granted Input Monitoring or Accessibility permissions in System Settings and remove unneeded entries.
Alert on the installation of unsigned or ad-hoc signed applications on managed macOS fleets.

How to Mitigate CVE-2026-65379

Immediate Actions Required

Apply the Apple security updates: upgrade to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 on all affected endpoints.
Inventory macOS devices in the environment and prioritize patching for systems used by privileged users, developers, and executives.
Review and revoke Input Monitoring and Accessibility permissions granted to applications that do not require them.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Security Advisory 149035, Apple Security Advisory 149042, and Apple Security Advisory 149043 for the complete list of addressed issues and installation guidance.

Workarounds

Restrict installation of unsigned or untrusted third-party applications by enforcing Gatekeeper and notarization requirements via MDM policy.
Limit standard users' ability to install software by applying least-privilege controls on managed macOS endpoints.
Enable application allowlisting to block execution of unknown binaries pending patch deployment.

bash

# Verify macOS build version on an endpoint
sw_vers -productVersion
sw_vers -buildVersion

# List applications with Input Monitoring permission (requires Full Disk Access)
sudo sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT client FROM access WHERE service='kTCCServiceListenEvent';"