CVE-2026-84572: Apple macOS Use-After-Free Vulnerability

CVE-2026-84572 Overview

CVE-2026-84572 is an out-of-bounds read vulnerability [CWE-125] in Apple macOS. A local application can trigger the flaw to cause unexpected system termination or read kernel memory. Apple addressed the issue with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The vulnerability requires local access with low privileges and no user interaction. Successful exploitation exposes kernel memory contents, which attackers can chain with other flaws to bypass Kernel Address Space Layout Randomization (KASLR) and escalate privileges.

Critical Impact
A local unprivileged app can read kernel memory or crash the system, potentially exposing sensitive kernel data and enabling further exploitation chains.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84572 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-84572

Vulnerability Analysis

CVE-2026-84572 is classified as an out-of-bounds read [CWE-125] affecting macOS. The affected code path reads memory beyond an intended buffer boundary because bounds validation is missing or incorrect prior to the read operation.

An attacker who can execute code on the target macOS host, including through a sandboxed or unprivileged application, can invoke the vulnerable path with crafted inputs. Depending on the memory layout at the time of the call, the read either returns adjacent kernel memory contents to userspace or dereferences an invalid address and triggers a kernel panic.

Because the affected component operates in kernel context, disclosed bytes can include pointers, cryptographic material, or other privileged state. Attackers typically use such disclosures to defeat KASLR and stage a second-stage memory corruption exploit.

Root Cause

The root cause is insufficient bounds checking on an index or length value used to access a buffer. Apple's advisory states the fix was implemented by adding improved bounds checking around the affected read operation.

Attack Vector

Exploitation requires local access. A malicious application running on the system triggers the vulnerable code path through a supported system interface. No user interaction is required. Apple has not disclosed the specific subsystem or system call involved, and no public proof-of-concept is available.

See the Apple advisories for the corresponding platform-specific details: Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043.

Detection Methods for CVE-2026-84572

Indicators of Compromise

Unexpected kernel panics or system reboots on macOS hosts running versions prior to Sequoia 15.8, Tahoe 26.7, or Golden Gate 27.
Unsigned or newly installed applications making anomalous system calls immediately before a panic event.
Repeated crash reports in /Library/Logs/DiagnosticReports/ referencing the same process across multiple hosts.

Detection Strategies

Collect and centralize macOS panic.ips and diagnostic reports for correlation across the fleet.
Baseline expected application behavior and alert on unsigned binaries invoking rare kernel interfaces followed by process termination.
Track macOS build versions across managed endpoints and flag hosts still running unpatched releases.

Monitoring Recommendations

Ingest Endpoint Security framework telemetry into a central analytics platform to observe process launches, code signing state, and anomalous crash sequences.
Alert when a non-privileged process precedes a kernel panic within a short time window on the same host.
Review MDM inventory reports weekly to confirm patch compliance on all Mac endpoints.

How to Mitigate CVE-2026-84572

Immediate Actions Required

Update all affected Mac endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as applicable.
Prioritize systems that run untrusted third-party software or where users install applications outside the App Store.
Enforce Gatekeeper and Notarization policies to reduce the likelihood of malicious local applications executing.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Consult the vendor advisories for build numbers and installation guidance: Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043.

Workarounds

No vendor-supplied workaround exists. Apply the patched macOS build.
Restrict installation of unsigned or untrusted applications through MDM configuration profiles until patching is complete.
Apply the principle of least privilege for local user accounts to reduce the attack surface available to malicious apps.

bash

# Verify the installed macOS version on an endpoint
sw_vers -productVersion

# Trigger a software update check via the command line
sudo softwareupdate --list
sudo softwareupdate --install --all --restart