CVE-2026-28931: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-28931 Overview

CVE-2026-28931 is a buffer overflow vulnerability in the Network File System (NFS) client implementation across Apple's operating systems. Connecting to a malicious NFS server can trigger kernel memory corruption, giving an attacker a path toward code execution in the kernel. Apple addressed the flaw with improved bounds checking in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. The weakness is tracked under CWE-120, classic buffer copy without checking size of input.

Critical Impact
A malicious NFS server can corrupt kernel memory on a connecting Apple device, enabling potential kernel-level code execution and full device compromise.

Affected Products

Apple iOS and iPadOS prior to 26.6
Apple macOS Tahoe prior to 26.6
Apple tvOS prior to 26.6 and watchOS prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-28931 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-28931

Vulnerability Analysis

The vulnerability resides in Apple's kernel-mode NFS client code, which parses responses returned by remote NFS servers. When processing attacker-controlled protocol fields, the client copies data into a fixed-size kernel buffer without adequately validating the input length. The resulting out-of-bounds write corrupts adjacent kernel memory structures.

Because NFS parsing runs inside the XNU kernel, successful exploitation grants an attacker influence over privileged memory. Depending on the layout of surrounding objects, corruption can be shaped into arbitrary write primitives, kernel information leaks, or control-flow hijacking. The victim must initiate the NFS mount, which explains the user-interaction requirement in the CVSS vector.

Root Cause

The defect is a classic missing bounds check (CWE-120) in the NFS client's response handling logic. A length or count field controlled by the server is trusted without verifying it against the destination buffer capacity. Apple's fix introduces explicit bounds validation before the copy operation, preventing writes beyond the intended allocation.

Attack Vector

Exploitation requires the target to connect to a malicious NFS server controlled by the attacker. This can occur through direct user action, such as mounting an NFS share via mount_nfs on macOS, or through applications and workflows that programmatically initiate NFS connections. On a compromised network, attackers can also redirect legitimate NFS mount attempts to a rogue server. Once the connection is established, the malicious server sends crafted RPC responses that trigger the overflow inside the kernel.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-28931

Indicators of Compromise

Unexpected NFS mount operations to external or unrecognized IP addresses, particularly outside RFC1918 ranges.
Kernel panic logs or com.apple.nfs fault entries in /Library/Logs/DiagnosticReports/ following NFS activity.
Outbound TCP or UDP traffic to port 2049 from endpoints that do not normally use NFS.

Detection Strategies

Inventory devices running iOS, iPadOS, macOS Tahoe, tvOS, and watchOS versions earlier than 26.6 and flag them as vulnerable.
Correlate NFS mount system calls with subsequent kernel crashes to identify exploitation attempts.
Alert on connections to NFS servers not present in an approved allowlist.

Monitoring Recommendations

Monitor endpoint logs for mount_nfs, nfsiod, and rpc.statd process activity on macOS.
Track kernel extension crash reports and system panic traces for signatures involving NFS client symbols.
Capture NetFlow or firewall logs for port 2049 traffic and review connections to untrusted destinations.

How to Mitigate CVE-2026-28931

Immediate Actions Required

Upgrade all Apple devices to iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, or watchOS 26.6 or later.
Block outbound NFS traffic (TCP/UDP 2049) at the network perimeter for devices that do not require it.
Restrict NFS mounts to a documented allowlist of internal, trusted servers.

Patch Information

Apple released fixes in iOS 26.6, iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, and watchOS 26.6. Refer to Apple's advisories for full version and build details: Apple Security Advisory #128066, Apple Security Advisory #128067, Apple Security Advisory #128068, and Apple Security Advisory #128069.

Workarounds

Avoid mounting NFS shares from untrusted or unknown servers until patches are applied.
Enforce network segmentation so that Apple endpoints can only reach approved NFS servers.
Use MDM policies to restrict configuration profiles that enable automatic NFS mounts on managed devices.

bash

# Configuration example: block outbound NFS at the host firewall (macOS pf)
# /etc/pf.conf snippet
block out proto { tcp udp } from any to any port 2049
# Reload rules
sudo pfctl -f /etc/pf.conf -e