Apple security updates for macOS, October 2026: out-of-bounds write fixed in Sequoia and Tahoe

The release at a glance

Apple published its October 2026 security updates for macOS on 26 October 2026. The release contains a single CVE in scope, CVE-2026-112593, and affects macOS only. The vulnerability is currently unscored: no CVSS severity is listed in the CVE record, and Apple has not assigned a vendor severity rating. It is not present in CISA's Known Exploited Vulnerabilities catalogue, and Apple has not stated that it is under active attack. No public disclosure is recorded in the CVE record, so this should be handled as a routine patching item rather than an emergency response.

The flaw itself is an out-of-bounds write that Apple addressed with improved bounds checking. Apple fixed the issue in macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. Because the release contains one CVE, there are no separate advisories or additional product groups to track this month. Apple's update does not mention a workaround, so installing the fixed version is the remediation. The concise scope makes risk assessment relatively simple: identify macOS devices, confirm their current version, and apply the corresponding update.

What matters most

CVE-2026-112593 is the only vulnerability in this release and concerns kernel memory. Apple describes an app that may be able to cause unexpected system termination or write kernel memory. Writing kernel memory from an app would cross a serious security boundary, so even without evidence of current exploitation the flaw deserves attention. The affected product is macOS, and Apple's fixes target two release branches: macOS Sequoia 15.8.2 and macOS Tahoe 26.7.2. Installations running macOS versions before 15.8.2 or before 26.7.2 are affected and should receive the update.

The CVE currently has no CVSS score, no CWE identifier, and no CISA KEV entry. The EPSS estimate is 0.2%, with a percentile of 10, which suggests a low estimated likelihood of exploitation. There is no vendor statement of exploitation, and no public disclosure is recorded in the CVE record. For prioritisation, this is not an emergency item, but a kernel memory issue is not something to leave unfixed on systems that run third-party applications. Treat it as a normal patch with a defined completion target.

Patch in this order

Patch in this order:

1. Update all Macs running macOS Sequoia to 15.8.2 and all Macs running macOS Tahoe to 26.7.2. These are the only fixed versions Apple has published for CVE-2026-112593. Apply the update first to shared workstations, kiosks, lab machines, and other systems where third-party or less-controlled local applications are run.

1. Confirm coverage through your device management inventory. Check the current macOS version on every managed Mac, including employee-owned devices that access corporate data. If an installation is on an older macOS branch, confirm with Apple whether an equivalent fix applies, because the advisory names only 15.8.2 and 26.7.2.

1. Follow normal change control for this cycle. There is no CISA KEV due date and no indication of active exploitation, so this update does not require an emergency change. Since no mitigation or workaround is stated in Apple's release, installing the update is the only remediation step available.

1. Record completion for audit and compliance evidence. A one-CVE release is simple to track, but documenting that the macOS population moved from vulnerable to fixed versions supports patch management reporting if NIS2 or DORA applies to your organisation.

Beyond the patch

A one-CVE Apple update is easy to understand, but it still tests the same supply-chain discipline as larger releases: you need to know which macOS versions are present, which builds are affected, and how quickly the fixed releases reach every device. Supply Chain Defense & Third-Party Risk helps track the Apple operating systems in your estate and confirms deployment coverage after a vendor fix, turning supplier patch cycles into a measurable exposure window. If you would like help fitting this into audit-ready patch management, book a meeting.