CVE-2026-43687: Apple iPadOS Kernel Memory Disclosure Flaw

CVE-2026-43687 Overview

CVE-2026-43687 is an information disclosure vulnerability affecting multiple Apple operating systems. The flaw stems from improper memory handling in the Network File System (NFS) client implementation. Connecting to a malicious NFS server may disclose kernel memory to the attacker-controlled endpoint. Apple addressed the issue with improved memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability is classified under [CWE-200] Information Exposure.

Critical Impact
A remote attacker operating a malicious NFS server can leak kernel memory contents from a victim device once the user initiates an NFS connection, potentially exposing sensitive kernel data useful for follow-on exploitation.

Affected Products

Apple iOS and iPadOS (fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27)
Apple macOS (fixed in macOS Tahoe 26.7 and macOS Golden Gate 27)
Apple tvOS 27, visionOS 27, watchOS 27

Discovery Timeline

2026-09-14 - CVE-2026-43687 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-43687

Vulnerability Analysis

The vulnerability resides in the Apple kernel's NFS client code path. When the client parses responses from a remote NFS server, insufficient memory handling causes uninitialized or out-of-bounds kernel memory to be included in structures returned during the session. A malicious server can shape its responses to reliably harvest this leaked memory. Because NFS response processing occurs in kernel context, the disclosed bytes may include pointers, credentials, or other sensitive kernel state useful for bypassing address space layout randomization (ASLR) or chaining with a code execution primitive.

Root Cause

The root cause is improper memory handling within NFS response parsing. Apple's advisory states the fix was implemented through improved memory handling, consistent with initialization or bounds-checking corrections applied to buffers returned across the trust boundary between the untrusted server and the kernel client.

Attack Vector

Exploitation requires network reachability and user interaction: the target must connect to an attacker-controlled NFS share. No privileges are required on the target device. Once the victim initiates the mount or file operation, the malicious server returns crafted RPC replies that trigger the disclosure. See Apple Support Article #149034 and related advisories for vendor detail.

No verified public proof-of-concept is available for this issue. The vulnerability mechanism is described in prose because no sanitized exploit code has been released.

Detection Methods for CVE-2026-43687

Indicators of Compromise

Outbound NFS traffic (TCP/UDP port 2049) from managed Apple endpoints to untrusted or unexpected external destinations.
User-initiated mount operations targeting NFS URIs originating from email, messaging apps, or malicious web pages.
Anomalous NFS RPC responses containing oversized or malformed reply payloads returned to Apple clients.

Detection Strategies

Inspect network telemetry for NFS session establishment to non-corporate file server infrastructure.
Correlate mount_nfs process execution on macOS endpoints with the destination server reputation.
Alert on Apple devices running OS versions below iOS/iPadOS 26.7, macOS Tahoe 26.7, tvOS/visionOS/watchOS 27 that initiate NFS traffic.

Monitoring Recommendations

Continuously track OS build versions across the Apple fleet to identify unpatched devices exposed to the flaw.
Log DNS resolution and connection attempts to hostnames advertising NFS shares from outside sanctioned file server ranges.
Enable endpoint telemetry that captures kernel extension and network file system activity for retrospective hunting.

How to Mitigate CVE-2026-43687

Immediate Actions Required

Deploy the vendor updates: iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Restrict outbound NFS (port 2049) traffic from user endpoints to only sanctioned internal file servers.
Instruct users not to mount NFS shares from untrusted sources or links delivered via untrusted channels.

Patch Information

Apple released fixes across the affected platforms with improved memory handling in the NFS client. Refer to the vendor advisories: Apple Support Article #149034, #149035, #149036, #149037, #149038, #149041, and #149042.

Workarounds

Block outbound TCP and UDP port 2049 at perimeter and endpoint firewalls where NFS is not required.
Disable NFS client functionality on macOS systems that do not require it via managed configuration profiles.
Enforce Mobile Device Management (MDM) policies that gate installation of configuration profiles containing NFS mount definitions.

bash

# Block NFS traffic on macOS using pfctl to reduce exposure
echo "block drop out proto { tcp udp } from any to any port 2049" | sudo pfctl -ef -

# Verify installed macOS build to confirm patch state
sw_vers -productVersion