CVE-2026-65380: Apple macOS Information Disclosure Vulnerability

CVE-2026-65380 Overview

CVE-2026-65380 is a permissions logic flaw in Apple macOS that affects the handling of file system snapshots. An application running on an affected system can leverage the weakness to access protected user data that should be restricted by macOS privacy controls. Apple resolved the issue in macOS Golden Gate 27 through improved permissions logic. The vulnerability requires local access and user interaction, and it maps to [CWE-863] Incorrect Authorization and [CWE-284] Improper Access Control. No public exploit or in-the-wild activity has been reported.

Critical Impact
A local application may bypass Transparency, Consent, and Control (TCC) style protections and read protected user data via snapshot handling.

Affected Products

Apple macOS versions prior to macOS Golden Gate 27
Applications relying on macOS snapshot-based file access controls
User data protected by macOS privacy and permissions frameworks

Discovery Timeline

2026-09-14 - CVE-2026-65380 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-65380

Vulnerability Analysis

The vulnerability resides in how macOS handles Apple File System (APFS) snapshots. Snapshots preserve point-in-time views of file system state, and access to their contents must honor the same permission model as the live volume. An application interacting with snapshot data can reach files that macOS privacy controls would otherwise block.

Exploitation requires local execution on the target system and user interaction, such as launching a malicious or trojanized application. The impact is limited to confidentiality of user data; integrity and availability are not affected according to the published metrics.

Root Cause

The root cause is incorrect authorization logic when evaluating access requests against snapshot content. The permissions layer did not consistently enforce user data protections for snapshot pathways, allowing an app to reach protected resources without the required entitlements or user consent.

Attack Vector

A local attacker delivers a malicious application to the user and induces execution. Once running with standard user privileges, the application queries or mounts snapshot state to read protected user directories, such as documents, photos, or messages data, that would normally require explicit consent. No elevated privileges are required for the initial access.

No verified proof-of-concept code is publicly available. Refer to the Apple Support Article for vendor technical details.

Detection Methods for CVE-2026-65380

Indicators of Compromise

Unexpected processes enumerating or mounting APFS snapshots via tmutil, diskutil apfs, or mount_apfs
Non-Apple applications reading paths under /Volumes/com.apple.TimeMachine.localsnapshots or .snapshots directories
Access to protected user data (~/Library, ~/Documents, ~/Pictures) originating from unsigned or newly installed binaries

Detection Strategies

Monitor Endpoint Security framework events for snapshot mount, list, and read operations correlated with untrusted binaries
Alert on invocations of snapshot-related utilities by processes lacking a legitimate backup or system-management role
Baseline normal snapshot access patterns per host and flag deviations initiated by user-installed applications

Monitoring Recommendations

Collect and retain macOS Unified Log entries for apfs, tccd, and mount_apfs subsystems
Forward endpoint telemetry to a centralized data lake for retrospective hunting across managed macOS fleets
Track code signing identifiers and notarization status for any process invoking snapshot APIs

How to Mitigate CVE-2026-65380

Immediate Actions Required

Upgrade affected endpoints to macOS Golden Gate 27 or later, which contains the corrected permissions logic
Inventory macOS assets and prioritize systems that handle sensitive user or regulated data
Restrict installation of unsigned or non-notarized applications through MDM policy

Patch Information

Apple addressed CVE-2026-65380 in macOS Golden Gate 27 by improving the permissions logic for snapshot handling. Deployment guidance and the full advisory are available in the Apple Support Article. Organizations managing macOS at scale should push the update through their MDM solution and validate installation via configuration reporting.

Workarounds

Limit local user privileges and enforce application allowlisting until patches are deployed
Educate users to avoid installing untrusted applications, since exploitation requires user interaction
Disable or restrict local Time Machine snapshots on high-sensitivity hosts where operationally acceptable

bash

# Verify macOS build and list local APFS snapshots for review
sw_vers -productVersion
tmutil listlocalsnapshots /