CVE-2026-28934: Apple macOS Buffer Overflow Vulnerability

CVE-2026-28934 Overview

CVE-2026-28934 is a buffer overflow vulnerability [CWE-120] in Apple macOS disk image handling. Mounting a malicious disk image can trigger unexpected system termination. Apple addressed the flaw with improved bounds checking. The issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The vulnerability requires user interaction to mount the crafted image but does not require prior authentication. Successful exploitation results in a denial-of-service condition on the affected host.

Critical Impact
Attackers can trigger unexpected system termination on macOS hosts by convincing a user to mount a malicious disk image, causing loss of availability.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-28934 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-28934

Vulnerability Analysis

The flaw resides in the macOS disk image parsing logic. A malformed disk image supplies data that exceeds the expected buffer size during mount operations. The lack of proper bounds enforcement leads to memory corruption and process termination. Apple's advisories describe the fix as improved bounds checking, consistent with a classic buffer overflow classified as [CWE-120].

Exploitation requires the victim to mount an attacker-supplied disk image, such as a .dmg file delivered via email, download, or removable media. macOS may auto-mount disk images opened from a browser, expanding the attack surface. The observed impact is high availability loss with no confidentiality or integrity impact, indicating the outcome is a system crash rather than code execution.

Root Cause

The root cause is missing or insufficient bounds checking during parsing of untrusted disk image metadata or content. When the parser copies attacker-controlled data into a fixed-size buffer, it overwrites adjacent memory, corrupting kernel or userland state and forcing termination. See the Apple security advisories for the specific components patched.

Attack Vector

The attack vector is network-adjacent through user interaction. An attacker hosts or distributes a crafted disk image and lures the target to open it. Once mounted, the vulnerable parser processes the malicious structure and the process or system terminates. No credentials or elevated privileges are required on the target.

No public proof-of-concept code is available for this issue. Refer to Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 for vendor technical details.

Detection Methods for CVE-2026-28934

Indicators of Compromise

Unexpected system reboots or kernel panics coinciding with .dmg or disk image mount events.
Presence of unsigned or unusually structured disk image files sourced from email attachments, downloads, or external media.
diskimages-helper or hdiutil process crashes recorded in system logs.

Detection Strategies

Monitor macOS unified logs for mount failures, hdiutil errors, and kernel panic reports referencing disk image subsystems.
Alert on disk image files downloaded from untrusted domains and subsequently mounted within a short window.
Correlate endpoint crash telemetry with recent file downloads to identify potential exploitation attempts.

Monitoring Recommendations

Collect and centralize macOS crash reports from /Library/Logs/DiagnosticReports/ for review.
Track macOS build versions across the fleet to identify hosts running versions earlier than 15.8, 26.7, or Golden Gate 27.
Baseline normal disk image mount activity per host so anomalous mounts stand out.

How to Mitigate CVE-2026-28934

Immediate Actions Required

Update affected endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as applicable.
Advise users not to open disk image files from untrusted sources such as unsolicited email or unknown websites.
Inventory macOS hosts and prioritize patching for systems that handle files from external parties.

Patch Information

Apple resolved CVE-2026-28934 with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Full details are available in Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043.

Workarounds

Restrict browser and email client auto-mount behavior for disk image attachments where feasible.
Enforce Gatekeeper and require notarization checks for downloaded files.
Use mobile device management policies to block execution of disk images from non-approved sources until patching completes.

bash

# Verify installed macOS version to confirm patch status
sw_vers -productVersion

# Apply available Apple software updates
sudo softwareupdate --install --all --restart