macOS Golden Gate 27
149035
Summary
No separate summary was provided in the collected bulletin.
View 5 component changes
App Store
Available for: macOS Tahoe 26.6 and later
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed by enforcing library validation on the affected binaries.
CVE-2026-86948: Ilya Andr (andrd3v) of Positive Technologies
CoreSymbolication
Available for: macOS Tahoe 26.6 and later
Impact: Parsing a maliciously crafted binary may lead to unexpected app termination
Description: An input validation issue was addressed with improved input validation.
CVE-2026-86875: Egor Saltykov
otool
Available for: macOS Tahoe 26.6 and later
Impact: Parsing a maliciously crafted binary may lead to unexpected tool termination
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2026-86874: Eddy T
Xcode
Available for: macOS Tahoe 26.6 and later
Impact: A malicious app may be able to break out of its sandbox
Description: This issue was addressed by enforcing library validation on the affected binaries.
CVE-2026-86949: Ilya Andr (andrd3v) of Positive Technologies
Xcode IDE
Available for: macOS Tahoe 26.6 and later
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65393: Mickey Jin (@patch1t)
Products covered
macOS Tahoe 26.6 and later
Remediation
Separate remediation guidance was not included in the collected bulletin.
CVEs in this advisory 5
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Added CVEs: CVE-2026-86874, CVE-2026-86875, CVE-2026-86948, CVE-2026-86949.
Updates
- Published by Apple Security Releases
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Confirmed at the source
Our collector saw this advisory during a later source check.