CVE-2026-84506

CVE-2026-84506 is a use-after-free vulnerability (CWE-416) in Apple's macOS that an app running on an affected Mac can trigger to execute arbitrary code with kernel privileges. Exploitation is local: the attacker must already have the ability to run an app on the target machine, but the flaw itself is low-complexity and requires no user interaction beyond launching the malicious app. Successful exploitation yields full kernel-level code execution, meaning complete compromise of the affected system with the highest possible privileges on macOS. All Macs running macOS versions prior to the fixed releases — Golden Gate before 27, Sequoia before 15.8, and Tahoe before 26.7 — are affected. Apple has addressed the issue with improved memory management; the flaw is not on the CISA KEV list and no public proof of concept or in-the-wild exploitation is known.

What to do: Patch affected Macs to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as appropriate for the OS line in use. Because exploitation requires a malicious or compromised app to already be running locally, enforce Gatekeeper/notarization, restrict software installation to trusted sources, and audit the list of installed applications on managed fleets. Monitor Apple security advisories and endpoint telemetry for signs of post-compromise privilege escalation on unpatched systems.