---
id: CVE-2026-86902
title: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation
summary: >-
  A parsing issue in the handling of directory paths was addressed with improved
  path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma
  14.8.8. An app may be able to access sensitive user data.
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: apple
product: macos
affected:
  - 'macos >= 14.0, < 14.8.8'
  - 'macos >= 15.0, < 27.0'
patched:
  - macos 27.0
published: '2026-09-14'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T15:09:51.000'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86902'
references:
  - url: 'https://support.apple.com/en-us/128072'
    label: product-security@apple.com
  - url: 'https://support.apple.com/en-us/149035'
    label: product-security@apple.com
tags:
  - nvd
  - cve.org
epss: 0.0014
epssPercentile: 0.03708
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T15:06:23.968127Z'
ingestedAt: '2026-09-14T21:15:17.508Z'
---

## Overview

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data.

## Affected

- `macos >= 14.0, < 14.8.8`
- `macos >= 15.0, < 27.0`

## Remediation

Upgrade past the affected range:

- `macos 27.0`