Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-84520: local kernel buffer overflow in Apple macOS

A local attacker can trigger a buffer overflow in macOS that may crash the system or corrupt kernel memory, potentially leading to privilege escalation or denial of service. This is CVE-2026-84520. Apple fixed the flaw in macOS Golden Gate 27; releases prior to 27 on the 27.x branch are affected. An attacker must have local access to the machine to exploit the issue; there are no facts here indicating remote network exploitation is possible without local code execution or user interaction.

Published Updated Source: CVE Program, NVD, FIRST EPSS

CVSS 3.1
9.8CRITICAL
EPSS
0.00445
CWE
CWE-120
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgent: install the macOS Golden Gate 27 update because the flaw permits local corruption of kernel memory, which can result in system crashes or privilege escalation. If you cannot patch immediately, restrict who can run code locally and increase endpoint monitoring for crashes and suspicious kernel activity.

What is CVE-2026-84520?

A local attacker can trigger a buffer overflow in macOS that may crash the system or corrupt kernel memory, potentially leading to privilege escalation or denial of service. This is CVE-2026-84520. Apple fixed the flaw in macOS Golden Gate 27; releases prior to 27 on the 27.x branch are affected. An attacker must have local access to the machine to exploit the issue; there are no facts here indicating remote network exploitation is possible without local code execution or user interaction.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Apple macOS are affected?

BRANCHAFFECTEDFIXED
27.xbefore 2727

Is CVE-2026-84520 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-84520

  1. Install macOS Golden Gate 27 on affected systems (fixed in 27).
  2. Restrict local access and limit ability to run untrusted binaries on macOS hosts.
  3. Monitor endpoints for unexpected system terminations and kernel-related error logs.
  4. Follow Apple’s security guidance and apply updates from the vendor promptly.

Frequently asked questions

Is CVE-2026-84520 being actively exploited?

There are no public reports of exploitation as of 2026-09-29.

Which macOS versions are affected by CVE-2026-84520?

macOS releases before Golden Gate 27 on the 27.x branch are affected; the issue is fixed in version 27.

Is there a patch for CVE-2026-84520?

Yes. Apple fixed the vulnerability in macOS Golden Gate 27; apply that update to remediate the issue.

Does CVE-2026-84520 require authentication?

Exploitation requires local access to the macOS system; there is no indication that remote unauthenticated network access is sufficient.

References