CVE-2026-113939

MediumCVSS 6.5/10Last modified Oct 29, 2026

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
ApplemacOS< 27.2

References

Timeline

Published
Oct 26, 2026
Last modified
Oct 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-1139405.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to causCVE-2026-1139417.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to causCVE-2026-1139427.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to causCVE-2026-1139436.5An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciouCVE-2026-1139447.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to causCVE-2026-1139455.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to causCVE-2026-1139467.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able CVE-2026-1139478.8This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted aCVE-2026-1139485.5A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify CVE-2026-1139498.8A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 2CVE-2026-113957.2The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pulCVE-2026-1139505.4An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate
CVE-2026-113939: Medium severity, CVSS 6.5 | Vulnix