CVE-2026-84525: Apple macOS Information Disclosure Vulnerability

CVE-2026-84525 Overview

CVE-2026-84525 is an information disclosure vulnerability in Apple macOS caused by insufficient data redaction in log output [CWE-532]. A local application with low privileges can read log entries containing user-sensitive data that should have been redacted. Apple addressed the flaw by improving redaction routines in the affected logging component. The issue is resolved in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

Critical Impact
A local app can access user-sensitive data that leaks through unredacted system log entries, undermining on-device privacy boundaries.

Affected Products

Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7
Apple macOS versions prior to Golden Gate 27

Discovery Timeline

2026-09-14 - CVE-2026-84525 published to the National Vulnerability Database (NVD)
2026-09-18 - CVE-2026-84525 last updated in NVD database

Technical Details for CVE-2026-84525

Vulnerability Analysis

The vulnerability stems from an Apple macOS system component writing user-sensitive data to log files without applying required redaction. Log entries intended to be sanitized instead contained plaintext values that expose private user information. Any local application with standard user privileges can query the log subsystem and read the exposed values. Exploitation does not require elevated privileges, user interaction, or network access.

The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File]. Apple's advisory states the fix addresses the problem "with improved data redaction," indicating the corrective work occurred in the logging path rather than in the calling APIs. The attack scope remains unchanged, meaning the exposure is confined to the local system boundary.

Root Cause

A logging routine in the affected macOS component emitted sensitive fields without invoking, or correctly invoking, the private-data redaction mechanism used elsewhere in the operating system. When third-party or lower-privileged code retrieves log entries through supported system APIs, those entries contain data that should have been marked private and redacted at emission time.

Attack Vector

A local attacker running an unprivileged application on the target macOS host reads system logs that contain unredacted sensitive fields. Because the disclosure occurs through legitimate logging interfaces, exploitation requires no memory corruption, no injected code, and no user prompts. See the Apple advisories for component-specific details: Apple Security Advisory 149035, Apple Security Advisory 149042, and Apple Security Advisory 149043.

No verified proof-of-concept code has been published. Refer to the vendor advisories for technical details.

Detection Methods for CVE-2026-84525

Indicators of Compromise

Unprivileged processes invoking log show, log stream, or the OSLog framework with broad predicate filters targeting sensitive subsystems.
Unexpected reads of files under /var/db/diagnostics/ or /var/db/uuidtext/ by non-administrative users or non-system binaries.
Sensitive strings (tokens, identifiers, email addresses) appearing in unified log output where <private> markers are expected.

Detection Strategies

Baseline which processes and users legitimately query the unified logging system, then alert on deviations from that baseline.
Hunt for command-line invocations of log collect, sysdiagnose, or scripted OSLog consumers running from user-writable directories.
Correlate log-access events with process lineage to identify short-lived or newly installed applications querying diagnostic data.

Monitoring Recommendations

Enable endpoint telemetry for macOS process execution and file access events on log directories.
Track installation and execution of new applications requesting Full Disk Access or diagnostic entitlements.
Ingest macOS unified logs and endpoint telemetry into a centralized data lake for retrospective hunting once patches are deployed.

How to Mitigate CVE-2026-84525

Immediate Actions Required

Update all macOS endpoints to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, depending on the installed major release.
Inventory macOS hosts and prioritize systems that handle regulated or sensitive user data.
Review recently installed third-party applications with access to diagnostic logs or Full Disk Access.

Patch Information

Apple resolved CVE-2026-84525 by improving data redaction in the affected logging component. Fixed versions are documented in Apple Security Advisory 149035, Apple Security Advisory 149042, and Apple Security Advisory 149043. Install the vendor updates through Software Update or an approved mobile device management (MDM) workflow.

Workarounds

No vendor-supplied workaround exists; patching is the only supported remediation.
Restrict installation of untrusted local applications and enforce application allow-listing until updates are deployed.
Limit which user accounts can access diagnostic tooling such as sysdiagnose and Console log export.

bash

# Verify installed macOS build after patching
sw_vers

# Enforce update deployment via MDM (example: mdmclient)
sudo softwareupdate --install --all --restart