CVE-2026-113943

MediumCVSS 6.5/10Last modified Oct 28, 2026

Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apple	macOS	< 27.2

References

https://support.apple.com/en-us/149521Release Notes, Vendor Advisory

Timeline

Published: Oct 26, 2026
Last modified: Oct 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1139447.1An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to caus CVE-2026-1139455.5An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able to caus CVE-2026-1139467.8An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2. An app may be able CVE-2026-1139478.8This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted a CVE-2026-1139485.5A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2. An app may be able to modify CVE-2026-1139498.8A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 2 CVE-2026-113957.2The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pul CVE-2026-1139505.4An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate CVE-2026-1139517.8If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes CVE-2026-1139525.4A logic issue was addressed with improved checks. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2 CVE-2026-1139575.6An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pul CVE-2026-113965.3The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Missing Authorization / Information Disclosure in all versio