PatchTheCVECVE-2026-84590: An out-of-bounds write issue was addressed with improved bounds checking
CVE-2026-84590 is a medium-severity flaw (CVSS 6.5) affecting macos. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination or heap corruption.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2026-10-26 |
| Last modified | 2026-11-04 |
Last updated 2026-11-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Research and news
- Vulners Bulletins: CVE-2026-84590 2026-10-26
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-84590?
macos: upgrade to 15.8.2, 26.7.2, 27.2. Exact commands for each OS are on this page.
Is CVE-2026-84590 being exploited?
CVE-2026-84590 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-84590 affect?
CVE-2026-84590 affects macos. Severity is medium (CVSS 6.5). An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A remote attacker may be able to cause unexpected app termination or heap cor
How urgent is CVE-2026-84590?
Priority 34/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2024-27834 MEDIUM 5.5 UPGRADE UPGRADE The issue was addressed with improved checks
- CVE-2026-112569 HIGH 8.2 UPGRADE An access issue was addressed with additional sandbox restrictions
- CVE-2026-112570 HIGH 8.2 UPGRADE An access issue was addressed with additional sandbox restrictions
- CVE-2026-112571 MEDIUM 5.5 UPGRADE UPGRADE A memory initialization issue was addressed with improved memory handling
- CVE-2026-112575 MEDIUM 6.2 UPGRADE The issue was addressed with improved handling of secure input state