CVE-2026-84505: Apple macOS Privilege Escalation Vulnerability

CVE-2026-84505 Overview

CVE-2026-84505 is an out-of-bounds write vulnerability [CWE-787] in Apple macOS that allows a local application to gain root privileges. Apple addressed the issue with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The flaw requires local access and low privileges but no user interaction, making it a viable second-stage payload after initial code execution. A malicious or compromised application executing on the system can leverage the memory corruption to escalate from a standard user context to root, resulting in full compromise of confidentiality, integrity, and availability.

Critical Impact
A local application can trigger an out-of-bounds write to gain root privileges on unpatched macOS systems, enabling full device takeover.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84505 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84505

Vulnerability Analysis

CVE-2026-84505 is classified as an out-of-bounds write [CWE-787]. The affected code path writes data beyond the bounds of an allocated buffer, corrupting adjacent memory. Apple's advisories state the condition was resolved through improved bounds checking, indicating that a length or index value was previously not validated against the destination buffer size.

Successful exploitation yields root-level code execution on the local system. Because the flaw is local rather than network-reachable, attackers typically chain it with an initial access primitive such as a malicious application download, a browser sandbox escape, or a supply-chain compromise.

The EPSS score is 0.168%, reflecting no observed in-the-wild exploitation at the time of publication. Apple has not confirmed active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Root Cause

The root cause is missing or insufficient bounds validation before a memory write operation. When untrusted input controls a size or index value, the affected routine writes past the end of the destination buffer. This overwrites adjacent kernel or process memory, which an attacker can shape to redirect execution or manipulate privilege-bearing structures. Apple's remediation adds explicit bounds checks to reject or clamp out-of-range values.

Attack Vector

Exploitation requires a local, authenticated attacker running code on the target macOS system. The attacker delivers a crafted application or process that triggers the vulnerable code path with input designed to cause the out-of-bounds write. No user interaction is required beyond initial execution of the malicious binary. After the write corrupts memory, the attacker gains root privileges and can disable security controls, install persistence, or access protected user data. Apple has not published exploitation specifics beyond the impact statement in its advisories.

Detection Methods for CVE-2026-84505

Indicators of Compromise

Unexpected processes running as root that were spawned by user-context applications
Kernel panics, unexpected reboots, or ReportCrash entries referencing memory corruption in system components
New launch daemons or launch agents written to /Library/LaunchDaemons/ or /Library/LaunchAgents/ following execution of an untrusted application
Modifications to System Integrity Protection (SIP) status or protected system directories

Detection Strategies

Monitor for privilege transitions where a non-privileged process spawns a child running as root without a legitimate sudo or authorization chain
Alert on execution of unsigned or ad-hoc signed binaries from user-writable locations such as /tmp, ~/Downloads, and ~/Library/Caches
Correlate crash reports in /Library/Logs/DiagnosticReports/ with subsequent privilege escalation activity
Track loading of unexpected kernel extensions or system extensions after untrusted application execution

Monitoring Recommendations

Ingest Endpoint Security Framework (ESF) telemetry into a centralized data lake for behavioral analytics across the macOS fleet
Track macOS version and build across managed endpoints to identify hosts still exposed to CVE-2026-84505
Baseline normal parent-child process relationships and alert on deviations that result in root execution

How to Mitigate CVE-2026-84505

Immediate Actions Required

Upgrade all macOS endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as applicable to each device
Inventory endpoints via Mobile Device Management (MDM) to confirm patch deployment across the fleet
Restrict installation of applications from untrusted sources and enforce Gatekeeper policies
Review recent application installations and process executions on high-value hosts for signs of exploitation

Patch Information

Apple published fixes in three advisories corresponding to the affected release trains: Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Administrators should apply the update matching each managed macOS train and verify installation via softwareupdate --history or MDM reporting.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation
Reduce local attack surface by removing standing local administrator rights from end users
Block execution of unsigned binaries and enforce notarization requirements through Gatekeeper
Use application allowlisting to prevent execution of unknown binaries in user-writable paths

bash

# Verify installed macOS version and confirm the patch is applied
sw_vers
softwareupdate --history

# Trigger MDM-managed update installation (example using softwareupdate)
sudo softwareupdate --install --all --restart