CVE-2026-84508
CodeSigningHelper lets an unentitled app read any root-readable file
- Vendor
- Apple
- Component
- Security (CodeSigningHelper)
- Severity
- Pending NVD analysis
- Status
- Fixed
Summary
com.apple.CodeSigningHelper.xpc, an XPC service inside Security.framework, runs as root with Full Disk Access and performs no check of its caller. It follows a symlink at a bundle’sContents/Info.plist and validates the caller-supplied hash against the wrong code directory slot. An application with no entitlements, no TCC grant and no administrator rights can read the contents of any file readable by root, with no prompt and no log record.
Apple’s advisory
Apple’s Security Research portal records this CVE against our report OE1106920714159, reported 30 July 2026 and addressed in iOS 27 and iPadOS 27 and macOS Golden Gate 27. Apple has stated that the credit for this report missed the initial advisory publication on 14 September 2026 and is being added.
As of 6 October 2026 the CVE entry has not yet appeared in the published security content for those releases, and the record is not yet public at NVD or MITRE. Apple’s impact and description text, the CVSS score and the credit line will be reproduced here when they are published.
Fixed in
- iOS 27 and iPadOS 27
- macOS Golden Gate 27
References
- NVD entry for CVE-2026-84508 (not yet published)
- Apple: About the security content of iOS 27 and iPadOS 27
- Apple: About the security content of macOS Golden Gate 27
The technical write-up is published separately at merrickhare.com. No proof-of-concept code is published for this issue.