CVE-2026-65364 Overview
CVE-2026-65364 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Apple macOS. A remote attacker can trigger the flaw over the network without authentication or user interaction, causing unexpected system termination. Apple addressed the issue by implementing improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
The vulnerability carries a CVSS 3.1 score of 7.5, reflecting the network-accessible attack surface and the high availability impact. Confidentiality and integrity are not affected, but the ability to remotely crash macOS systems creates a denial-of-service risk for enterprise fleets.
Critical Impact
A remote, unauthenticated attacker can cause unexpected macOS system termination, disrupting availability across affected endpoints.
Affected Products
- Apple macOS versions prior to Golden Gate 27
- Apple macOS Sequoia versions prior to 15.8
- Apple macOS Tahoe versions prior to 26.7
Discovery Timeline
- 2026-09-14 - CVE-2026-65364 published to the National Vulnerability Database
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-65364
Vulnerability Analysis
CVE-2026-65364 is classified as an out-of-bounds read [CWE-125]. The affected macOS component reads memory beyond the intended buffer boundary when processing attacker-supplied data received over the network. The resulting invalid memory access triggers a fault that terminates the affected process or the operating system.
Apple's advisory notes the flaw was addressed with improved bounds checking. This indicates the vulnerable code path performed insufficient validation of length or offset values before dereferencing memory. Because the network attack vector requires no privileges and no user interaction, an attacker can reach the vulnerable code by sending a crafted request to an exposed macOS service.
The vulnerability does not expose memory contents to the attacker in a form usable for information disclosure, according to the CVSS scoring. The observed impact is limited to availability loss through unexpected system termination.
Root Cause
The root cause is missing or insufficient bounds validation on data read from a buffer during network-facing processing. When the input length or index exceeds the allocated buffer, the read crosses into adjacent or unmapped memory, producing an access violation that crashes the process or kernel.
Attack Vector
Exploitation occurs remotely over a network. An attacker sends a malformed message to a vulnerable macOS service that processes the input without validating boundaries. Successful delivery causes unexpected termination of the target system. No authentication, user interaction, or local access is required.
Apple has not published the specific component or protocol involved. Consult the Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 advisories for further vendor context.
Detection Methods for CVE-2026-65364
Indicators of Compromise
- Unexpected kernel panics or system reboots on macOS endpoints coinciding with inbound network traffic
- Repeated crash reports in /Library/Logs/DiagnosticReports/ referencing the same system service
- Anomalous inbound traffic patterns targeting macOS listening services from untrusted networks
Detection Strategies
- Monitor macOS crash logs and ReportCrash telemetry for recurring terminations of the same process
- Correlate endpoint crash events with network flow data to identify remote sources triggering the fault
- Track macOS build versions across the fleet to identify hosts running versions below Golden Gate 27, Sequoia 15.8, or Tahoe 26.7
Monitoring Recommendations
- Alert on clusters of macOS crashes across multiple endpoints within short time windows, which may indicate active exploitation
- Log and review inbound connections to macOS network services from outside trusted subnets
- Baseline normal macOS uptime and generate alerts on unexpected reboot patterns
How to Mitigate CVE-2026-65364
Immediate Actions Required
- Upgrade affected macOS systems to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 without delay
- Inventory macOS endpoints and prioritize patching for internet-facing or high-value hosts
- Restrict network exposure of macOS services to trusted networks until patches are applied
Patch Information
Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 for version-specific update instructions and release notes.
Workarounds
- Block inbound network access to non-essential macOS services at perimeter and host firewalls
- Segment macOS endpoints from untrusted networks to reduce remote reachability
- Enable automatic macOS software updates to ensure timely deployment of security fixes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
