Microsoft patches Defender for macOS CVE-2026-50657 and CVE-2026-50658

Security researcher Eugene Lim discovered two vulnerabilities in Microsoft Defender for macOS involving inter-process communication peer validation bypasses and Time-of-Check to Time-of-Use race conditions. The flaws, designated CVE-2026-50657 and CVE-2026-50658, allow unprivileged local users to achieve arbitrary file read and arbitrary file write as root. Microsoft has since patched both vulnerabilities. Open article →