Summary
Apple released macOS Golden Gate 27 on September 14, 2026, addressing vulnerabilities across macOS components including the kernel, Bluetooth, file systems and image processing. The advisory lists potential impacts ranging from data access and privacy-bypass issues to sandbox escapes and arbitrary code execution.
Apple released macOS Golden Gate 27 on September 14, 2026, with security fixes across core operating-system components. Apple’s advisory lists vulnerabilities affecting areas including the kernel, Bluetooth, file systems, account authentication, privacy controls, media handling and disk images.
The document identifies individual issues by CVE identifier where possible. Their listed impacts range from unexpected application or system termination to access to sensitive data, sandbox escapes, privilege escalation and arbitrary code execution.
Vulnerabilities addressed across macOS
Several entries concern maliciously crafted content or files. Fixes in CoreMedia, ImageIO, CoreUI and related components address memory-safety problems involving images, videos, fonts and asset catalogues. The listed defects include out-of-bounds reads and writes, buffer overflows, uninitialised memory and memory corruption. These types of errors occur when software handles data outside the memory region assigned to it, potentially causing a crash or exposing data held by another process.
Apple also lists fixes for disk images and removable-volume formats. Issues in Disk Images, HFS and exFAT could allow a maliciously crafted image or volume to cause system termination, corrupt kernel memory or disclose kernel memory. Another file-handling issue in file_cmds involved extracting a malicious archive and could allow arbitrary file writes.
Security boundaries were another major area of the update. Apple says fixes in Apple Mobile File Integrity, Archive Utility, Automator and iWork address problems that could let a malicious app escape its sandbox. A sandbox restricts an application’s access to system resources and user data, so escaping it can give an app capabilities beyond those intended by the operating system.
The advisory also lists an autofs issue that could allow an attacker controlling a network directory server to execute arbitrary code with root privileges, as well as another issue that could bypass Gatekeeper checks. Gatekeeper is macOS’s mechanism for checking software obtained from outside trusted distribution channels before it is opened.
Privacy, accounts and hardware interfaces
Multiple fixes address access-control and authentication problems. Apple says vulnerabilities in Accessibility, Accounts, CoreServices, Apple Account, App Store, CoreML and other components could allow an app to access sensitive or restricted data, bypass Privacy preferences, read persistent identifiers or use the Sign in with Apple authentication flow to access an Apple Account.
The update also covers Apple Intelligence and the Apple Neural Engine. One Apple Intelligence issue could allow an app to bypass security prompts, while an Apple Neural Engine issue could cause unexpected system termination through an integer-overflow defect.
Bluetooth-related fixes include a vulnerability that Apple says could allow a remote attacker to cause an application to terminate unexpectedly or execute arbitrary code. Other Bluetooth entries address unauthorised access to Bluetooth, possible root privileges and access to Bluetooth device information.
The range of affected components matters because macOS security is built from several layers: applications process files and network data, permission systems control access to user information, and the kernel manages fundamental operating-system functions. A defect in any one layer can have consequences beyond the component where it is located, particularly when it affects a privilege boundary or kernel memory.
Macs listed as compatible
Apple’s security document lists macOS Golden Gate 27 for the following systems:
- MacBook Neo (2026)
- MacBook Air with Apple silicon (2020 and later)
- MacBook Pro with Apple silicon (2020 and later)
- iMac with Apple silicon (2021 and later)
- Mac mini with Apple silicon (2020 and later)
- Mac Studio (2022 and later)
- Mac Pro with Apple silicon (2023)
The advisory describes the potential impact of each vulnerability and the engineering change used to address it, such as improved bounds checking, input validation, additional restrictions, entitlement checks, memory handling or removal of vulnerable code. It is a security advisory describing fixes and potential attack outcomes; it does not report a measured attack campaign or exploit prevalence.