CVE-2026-43815: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43815 Overview

CVE-2026-43815 is a buffer overflow vulnerability in Apple macOS affecting the Apple Filing Protocol file system (afpfs) client. A malicious Apple Filing Protocol (AFP) server can send crafted responses that trigger kernel memory corruption on a connecting client. Apple addressed the issue with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.

The flaw is classified as an out-of-bounds write [CWE-787] and is reachable over the network when a user initiates an AFP connection to an attacker-controlled server. Successful exploitation impacts kernel-level confidentiality, integrity, and availability.

Critical Impact
A malicious afpfs server can corrupt kernel memory on any macOS client that connects to it, enabling potential kernel-level code execution or system compromise.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-09-14 - CVE-2026-43815 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-43815

Vulnerability Analysis

The vulnerability resides in the macOS afpfs kernel component, which implements the client side of the Apple Filing Protocol. AFP is a legacy network file-sharing protocol still supported by macOS for interoperability with older file servers. When a client connects to an AFP server, the kernel parses protocol responses to negotiate the session and map remote resources.

The afpfs code fails to validate the size of certain server-supplied fields before copying them into a fixed-size kernel buffer. A malicious server can return oversized values that exceed the destination buffer's capacity, resulting in an out-of-bounds write in kernel memory. Because the vulnerable code executes in the kernel, corruption can affect adjacent structures and control-flow-relevant data.

Root Cause

The root cause is missing bounds checking on server-controlled input during AFP session handling. Apple's advisory states the issue was addressed with improved bounds checking, indicating the fix adds length validation before the memory copy. The weakness maps to [CWE-787] Out-of-bounds Write.

Attack Vector

Exploitation requires a user to connect from a vulnerable macOS system to an attacker-controlled AFP server, for example through Finder's Connect to Server dialog using an afp:// URL, a mounted share, or an automated login item. Once the connection is initiated, the malicious server returns crafted protocol responses that trigger the kernel overflow.

The attack is network-reachable, requires low complexity, and does not require prior authentication, but user interaction is necessary to initiate the AFP connection. Successful exploitation yields kernel memory corruption, which an attacker can potentially chain into arbitrary kernel code execution or privilege escalation. No public proof-of-concept or in-the-wild exploitation has been reported.

Apple has not published exploitation code. See the Apple advisories for available technical detail: Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072.

Detection Methods for CVE-2026-43815

Indicators of Compromise

Outbound TCP connections to untrusted hosts on port 548 (AFP) from macOS endpoints.
Unexpected mount_afp process executions or afp:// URLs opened from Finder, scripts, or login items.
Kernel panic logs referencing the afpfs KEXT or AFP client stack in /Library/Logs/DiagnosticReports/.
macOS endpoints running builds older than 15.7.8, 14.8.8, or 26.6 that initiate AFP sessions to external networks.

Detection Strategies

Inventory macOS build numbers via MDM (Jamf, Intune, Kandji) and flag hosts below the patched versions.
Alert on process telemetry showing mount_afp, NetAuthSysAgent, or open invocations that reference afp:// URIs.
Correlate outbound port 548 traffic with the initiating process and destination reputation.

Monitoring Recommendations

Enable EDR telemetry for network connections and process launches on all macOS endpoints and forward to a central SIEM.
Monitor for kernel panic reports and crash dumps that mention AFP or afpfs symbols and treat them as potential exploitation attempts.
Track newly mounted network volumes and share URIs to detect connections to unapproved AFP servers.

How to Mitigate CVE-2026-43815

Immediate Actions Required

Apply the Apple security updates: upgrade to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Block outbound TCP port 548 at the network perimeter unless AFP is a documented business requirement.
Instruct users not to connect to untrusted afp:// shares and remove any stored AFP server entries from Finder favorites and login items.

Patch Information

Apple released fixes across three supported macOS trains. Refer to the vendor advisories: Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072. Deploy updates through Software Update or your MDM platform and confirm the resulting build via sw_vers.

Workarounds

Restrict egress traffic to TCP port 548 using a host firewall or perimeter policy where AFP is not required.
Disable automatic mounting of AFP shares and remove afp:// entries from user login items.
Migrate legacy file shares from AFP to SMB, which is the current Apple-recommended file-sharing protocol.

bash

# Verify the installed macOS build matches or exceeds a patched version
sw_vers

# Block outbound AFP (TCP/548) using the packet filter on macOS
echo "block drop out proto tcp to any port 548" | sudo pfctl -ef -

# List any currently mounted AFP volumes
mount | grep -i afpfs