CVE-2026-84548 is a high severity (CVSS 7.1) integer overflow in macOS Quick Look, the file preview feature. Processing a maliciously crafted document may lead to an out-of-bounds read. Apple fixed it in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS. Apple lists the fix under the Quick Look component, the feature that shows file previews in Finder and other apps. Apple describes the impact as follows: processing a maliciously crafted document may lead to an out-of-bounds read. It says an integer overflow was addressed with improved input validation.
The CVSS vector in the record is local, low complexity and no privileges, with user interaction required, and a high impact on confidentiality and availability. The user interaction is the person opening or previewing the file. Apple does not say which document types are involved.
The record says the fix shipped in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, both dated 14 September 2026, and they list this CVE. I did not fetch the page for Sequoia 15.8, so I rely on the record for that one.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update each Mac to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7, whichever your hardware and policy support.
- Use your device management tool to push the update and report which Macs have not applied it.
- Set a deadline for Macs that are overdue, and follow up with their owners.
- Keep automatic security updates switched on for personal and unmanaged Macs.
- Treat documents from unknown senders with care, and avoid previewing files you do not trust until the Mac is updated.
Why it matters
Integer overflow, tracked as CWE-190, means a number wraps around when arithmetic exceeds its limits. In a file parser, that can make the code believe a piece of data is shorter than it is, or place a read in the wrong location. The result Apple describes is an out-of-bounds read. That can crash the process or reveal memory contents.
Preview features run automatically, which is why they are a favourite target. The user does not have to open the file in an app, only to select it or see it in a folder. Apple's wording still requires the user to process the document, and the record does not list this CVE as exploited in the wild. Updating closes the door without any change in behaviour.
Quick check
Do I have to open the file for this to matter?
Apple says processing a crafted document. Previewing in Quick Look is the feature involved, so the file need not be opened in an app.
Is this the same as a code execution bug?
No. Apple describes an out-of-bounds read, and the record rates availability and confidentiality impact, not integrity.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
