CVE-2026-84565 is a high severity (CVSS 7.1) out-of-bounds read in macOS Disk Images, the component that handles mounted images. Processing a maliciously crafted disk image may lead to unexpected app termination. Apple fixed it in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS. Apple lists the fix under the Disk Images component and describes the impact as follows: processing a maliciously crafted disk image may lead to unexpected app termination. Apple says an out-of-bounds read was addressed with improved bounds checking.
The CVSS vector in the record is local, low complexity and no privileges, with user interaction required and a high impact on confidentiality and availability. The user interaction is mounting or opening the image, for example one downloaded from a website or received by email. Disk image files, the common DMG format for software downloads, are everywhere in Mac workflows, which is why this parser sees a lot of untrusted input.
The record says the fix shipped in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, both dated 14 September 2026, and they list this CVE. I did not fetch the page for Sequoia 15.8, so I rely on the record for that one.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update each Mac to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7, whichever your hardware and policy support.
- Use your device management tool to push the update and report which Macs have not applied it.
- Set a deadline for Macs that are overdue, and follow up with their owners.
- Keep automatic security updates switched on for personal and unmanaged Macs.
- Mount disk images only from sources you trust, and delete unknown images instead of opening them.
Why it matters
An out-of-bounds read, tracked as CWE-125, is a parsing mistake. The code trusts a length or offset inside the file and reads past what it has. A disk image is a complex container with its own structures, which gives a parser plenty of places to get this wrong. Apple's note says the symptom is an app terminating. The record also rates a high confidentiality impact, which fits the possibility of reading memory.
For most people the safe habit is simple: mount images only from sources you trust, and update promptly. For IT teams, the useful action is to confirm the update has reached every Mac, including laptops that rarely connect to the office. The record does not list this CVE as exploited in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does the user have to do?
Open or mount a crafted disk image. The vector requires user interaction.
Does Gatekeeper stop this?
Apple's notes do not say. Do not rely on it. Update the Mac.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
