CVE-2026-43719: Apple macOS Use-After-Free Vulnerability

CVE-2026-43719 Overview

CVE-2026-43719 is a use-after-free vulnerability [CWE-416] in Apple macOS Server Message Block (SMB) handling. Mounting a maliciously crafted SMB network share can trigger memory corruption and cause system termination. Apple addressed the flaw through improved memory management in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The vulnerability requires user interaction to mount the malicious share but no privileges or authentication on the target system. Successful exploitation results in a denial-of-service condition through kernel or process termination. No confidentiality or integrity impact is documented.

Critical Impact
A remote attacker hosting a malicious SMB share can force system termination on any macOS host that mounts the share, disrupting availability of the affected system.

Affected Products

Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7
Apple macOS versions prior to Golden Gate 27

Discovery Timeline

2026-09-14 - CVE-2026-43719 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-43719

Vulnerability Analysis

The flaw is a use-after-free condition in the macOS SMB client code path invoked when mounting a remote share. During the mount operation, the client parses server-supplied SMB protocol structures. A crafted response from a malicious SMB server causes the client to reference a memory object after it has been released.

Dereferencing freed memory produces undefined behavior in the SMB handling routines. In this instance, the corrupted state propagates to the kernel or a system process, resulting in termination of the affected component. Apple's advisories describe the fix as improved memory management, indicating tighter object lifecycle handling on the affected code paths.

Root Cause

The root cause is improper memory lifecycle management in the SMB client. An object is freed while a pointer to it remains reachable and is later dereferenced during mount processing. Attacker-controlled server responses influence the code path and trigger the reuse of freed memory.

Attack Vector

The attack vector is network-based. An attacker operates or compromises an SMB server and induces a target user to mount the malicious share, for example through a smb:// link, a phishing lure, or an autoconfigured network location. No credentials on the target host are required, but user interaction is required to initiate the mount. Successful exploitation causes system termination on the client.

No public proof-of-concept, exploit, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.298%.

See Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor details.

Detection Methods for CVE-2026-43719

Indicators of Compromise

Unexpected system panics, reboots, or mount_smbfs process crashes on macOS hosts following an SMB mount attempt.
Outbound SMB connections (TCP 445) from macOS endpoints to untrusted or non-corporate hosts.
User-initiated smb:// URL handling from email clients, browsers, or messaging applications that precedes a crash.

Detection Strategies

Monitor macOS unified logs and crash reports for entries related to smbfs, mount_smbfs, or kernel SMB modules near the time of a mount event.
Correlate endpoint crash telemetry with preceding network events to untrusted SMB endpoints.
Alert on macOS hosts running versions below Sequoia 15.8, Tahoe 26.7, or Golden Gate 27 that also generate SMB traffic to external destinations.

Monitoring Recommendations

Baseline legitimate SMB destinations for macOS fleets and alert on deviations.
Track patch status of macOS endpoints against the fixed release train through mobile device management (MDM) inventory.
Log user actions that invoke smb:// URL handlers to attribute crashes to a specific mount attempt.

How to Mitigate CVE-2026-43719

Immediate Actions Required

Update all macOS endpoints to Sequoia 15.8, Tahoe 26.7, or Golden Gate 27, whichever matches the installed release train.
Block outbound SMB (TCP 445) at the network perimeter to prevent connections to attacker-controlled servers on the internet.
Restrict smb:// URL auto-handling from untrusted sources including email and web content.

Patch Information

Apple released fixes in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for the specific advisory that matches your macOS release.

Workarounds

Do not mount SMB shares from untrusted or unknown servers until patches are applied.
Enforce an MDM policy that limits SMB client connections to an allowlist of internal file servers.
Disable automatic handling of smb:// links in browsers and mail clients where feasible.

bash

# Verify macOS version and confirm patch level
sw_vers

# Example: firewall rule to block outbound SMB via pf
# /etc/pf.conf
block drop out proto tcp to any port 445