Improper access control in macOS - CVE-2026-112500
Published: October 27, 2026
Vulnerability identifier: #VU157892
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-112500
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass access restrictions, potentially gaining unauthorized access to protected resources.
The vulnerability exists due to improper access control in the Mail component of macOS when enforcing access restrictions. A local user can attempt operations that are not properly authorized to bypass intended access controls.
Affected software
macOS
Apple iOS
iPadOS
Apple iOS
iPadOS
How to mitigate CVE-2026-112500
Install update from vendor's website.
macOS - update to 27.2 26B123
Apple iOS - addressed in versions 27.2 24B119, 27.2 24B120, 27.2 24B91020
iPadOS - update to 27.2 24B119
Apple iOS - addressed in versions 27.2 24B119, 27.2 24B120, 27.2 24B91020
iPadOS - update to 27.2 24B119