Apple security updates for macOS, October 2026: one out-of-bounds write fixed in Sequoia and Tahoe

The release at a glance

Apple published its October 2026 macOS security updates on 26 October 2026. The release covers a single vulnerability in macOS: CVE-2026-112593, an out-of-bounds write that Apple says was addressed with improved bounds checking. According to Apple's advisory, an app may be able to cause unexpected system termination or write kernel memory. Fixes are available in macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2.

No CVSS score is provided in the advisory, so our severity table marks this issue as unscored. CISA's KEV catalogue does not list the CVE, and the advisory reports no active exploitation or public disclosure. The EPSS value is 0.2 percent at the 10th percentile. The release contains one CVE in total; no other CVEs are in scope.

What matters most

CVE-2026-112593 is the only vulnerability in this release. It affects macOS before 15.8.2 and before 26.7.2, covering both the Sequoia and Tahoe lines. The underlying flaw is an out-of-bounds write. In Apple's wording, an app may be able to cause unexpected system termination or write kernel memory. The advisory does not state what privilege level an app would need.

There is no CVSS score, no CWE identifier, no vendor severity rating, and no SSVC vector in the advisory, so this CVE cannot be compared with a numeric severity. It is not in CISA KEV and there is no reported exploitation or public disclosure. The EPSS value is 0.2 percent at the 10th percentile. For prioritisation, the main reason to act is the stated kernel-memory impact on a widely deployed OS rather than an active attack.

Patch in this order

1. Identify the Macs that need the update. Treat any macOS Sequoia installation before 15.8.2 and any macOS Tahoe installation before 26.7.2 as affected.
2. Deploy the matching fixed version: macOS Sequoia 15.8.2 or macOS Tahoe 26.7.2. These are the only fixed versions listed for this CVE, and the release contains no other CVEs.
3. Treat this as a standard Apple patch cycle update, not an emergency change. The CVE is not exploited, not in CISA KEV, and not publicly disclosed, so there is no CISA due date to work towards. Your urgency should reflect the lack of active exploitation and the absence of a CVSS score rather than a high-severity trigger.
4. Validate coverage after deployment. Use your normal macOS endpoint management or MDM reporting to confirm every Mac reports one of the two fixed versions and that no affected Sequoia or Tahoe build remains.
5. Watch Apple's advisory pages for any revision. The advisory does not state a workaround, so patching is the control to rely on. If you need to postpone, document the residual risk and review it at the next patch window.

Because this is a one-CVE release, the operational load is small; the priority is knowing which of the two macOS branches exist in your estate and confirming they are updated.

Beyond the patch

Even a one-CVE macOS release is easier to manage when you can see which Apple operating system versions are deployed and how quickly Apple publishes fixes. Supply Chain Defense & Third-Party Risk gives that supplier patch-cycle visibility, so a small, unscored update does not linger unseen on a subset of Macs. If you are building evidence for NIS2 or DORA, NIS2 / DORA frameworks can help you place this type of update into your documented patch management cycle, or you can Book a meeting with an advisor.