CVE-2026-84584 Details
Description
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox.
A vulnerability in the Archive Utility component of macOS Golden Gate 27 allows applications to break out of their sandbox. This issue arises from improper handling of symbolic links, which could be exploited by maliciously crafted files. The vulnerability affects MacBook Neo (2026), MacBook Air, MacBook Pro, iMac, Mac mini, Mac Studio, and Mac Pro, all with Apple silicon.
Users can update to macOS Golden Gate 27 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.apple.com/en-us/149035 | [email protected] | Release NotesVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| apple macos | < 27.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Sep 14, 2026 | New CVE Received | [email protected] |