ZeroHour

CVE-2026-64790

mass

macOS Path Validation Flaw Lets Apps Gain Elevated Privileges

CVSS
EPSS
Published
()
Modified
AI analysis

CVE-2026-64790 is a path handling vulnerability in Apple's macOS in which insufficient validation of file paths allows a malicious or compromised application to gain elevated privileges on the system. Exploitation is local: an attacker must first get their app running on a target Mac, then abuse the flawed path handling to escalate beyond the app's normal permissions. The issue was fixed with improved validation in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, so Macs running earlier builds of these release lines remain exposed. NVD has not yet assigned a CVSS score, there is no known public proof-of-concept, and the flaw is not in CISA's KEV catalog, though it shipped as part of a record-setting batch of Apple patches. No exploitation in the wild has been reported.

What to do: Update affected Macs to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 or later via System Settings > General > Software Update, and verify patch status across the fleet. Because exploitation requires a local app to be running, keep Gatekeeper and notarization enforcement enabled, restrict installation of unvetted software, and monitor endpoint logs for apps spawning higher-privilege processes. Note this fix landed in a record-sized Apple update wave, so triage the other CVEs patched in the same releases as well.

Affected
Apple macOS Sequoiaprior to 15.8 (fixed in 15.8)
Apple macOS Tahoeprior to 26.7 (fixed in 26.7)
Apple macOS Golden Gateprior to 27 (fixed in 27)
Estimated exposure
masstens of millions of Macs (unpatched share of Apple's ~100M+ active Mac installed base across three macOS release lines) — Apple's active Mac installed base is widely estimated at well over 100 million devices, and because the flaw spans three macOS release lines, every Mac not yet updated to the fixed builds is a plausible target.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain elevated privileges.

In the news

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.