CVE-2026-65365: Apple macOS Information Disclosure Vulnerability

CVE-2026-65365 Overview

CVE-2026-65365 is an out-of-bounds read vulnerability [CWE-125] in the Server Message Block (SMB) client component of Apple macOS. An attacker who controls a malicious SMB share can trigger the flaw when a user connects to it, causing the kernel to read memory outside an allocated buffer. The result is disclosure of kernel memory contents to the attacker-controlled endpoint.

Apple addressed the issue with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires user interaction, since the target must initiate a connection to the malicious share.

Critical Impact
Successful exploitation leaks kernel memory to a network-adjacent attacker, exposing pointers, cryptographic material, or other sensitive kernel data that can be used to defeat kernel address space layout randomization (KASLR) and stage follow-on attacks.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-65365 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65365

Vulnerability Analysis

The vulnerability resides in the macOS SMB client code path that parses responses from a remote SMB server. When the client connects to a malicious share, crafted server responses cause the client to read past the end of an allocated kernel buffer. The out-of-bounds bytes are subsequently returned or processed in a way that exposes them to the remote endpoint.

Because the flaw executes inside the kernel, leaked bytes may include kernel pointers, stack canaries, session keys, or fragments of unrelated file data cached in kernel memory. Attackers frequently chain such reads with memory-corruption bugs to bypass KASLR and achieve reliable kernel exploitation.

User interaction is required. The victim must mount or connect to a share hosted on infrastructure controlled by the attacker, for example via an smb:// URL delivered through phishing, a malicious document, or a compromised captive portal.

Root Cause

The root cause is missing or insufficient bounds checking when the SMB client processes a length or offset field from a server response. The client trusted server-supplied metadata and used it to index into a fixed-size buffer without validating that the computed range remained within the allocation.

Attack Vector

The attack is network-adjacent and requires the victim to connect to an attacker-controlled SMB server. The attacker sends malformed SMB response packets during the session. Confidentiality is impacted (kernel memory disclosure); integrity and availability are not directly affected.

No public proof-of-concept exploit or CISA Known Exploited Vulnerabilities (KEV) listing exists for CVE-2026-65365 at the time of publication. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor-supplied technical context.

Detection Methods for CVE-2026-65365

Indicators of Compromise

Outbound SMB connections (TCP/445) from macOS endpoints to untrusted or previously unseen external hosts.
User-initiated mounts of smb:// URLs originating from email attachments, chat links, or web browsers.
Unexpected mount_smbfs or NetAuthAgent process activity contacting non-corporate IP ranges.

Detection Strategies

Correlate process telemetry for mount_smbfs, smbd, and NetAuthSysAgent with destination IP reputation and geolocation.
Alert on macOS hosts establishing SMB sessions to hosts outside approved file-server allowlists.
Inspect endpoint logs for kernel panics or SMB client errors that may indicate exploitation attempts against unpatched systems.

Monitoring Recommendations

Ingest macOS Unified Log data covering the com.apple.smb and com.apple.NetAuthAgent subsystems into your SIEM.
Baseline normal SMB destinations per user and flag deviations, particularly connections to public cloud or residential IP space.
Monitor DNS and proxy logs for URLs using the smb:// or cifs:// schemes.

How to Mitigate CVE-2026-65365

Immediate Actions Required

Update all macOS systems to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7, depending on the installed major version.
Prioritize patching for laptops and endpoints that regularly operate on untrusted networks.
Instruct users not to open smb:// links from untrusted sources until patches are deployed.

Patch Information

Apple resolved CVE-2026-65365 by adding improved bounds checking to the SMB client. Fixed builds are macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. See Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for the corresponding advisories.

Workarounds

Block outbound TCP/445 and TCP/139 at the network perimeter for endpoints that do not require external SMB access.
Restrict SMB client connections to an allowlist of approved internal file servers using firewall or MDM policy.
Disable automatic handling of smb:// URL schemes in browsers and email clients where feasible.

bash

# Verify installed macOS version and confirm it is at or above a fixed build
sw_vers -productVersion

# Apply pending Apple security updates non-interactively
sudo softwareupdate --install --all --restart

# Example pf firewall rule to block outbound SMB to non-RFC1918 destinations
# Add to /etc/pf.anchors/com.company.smb and load via pfctl
block drop out proto tcp from any to ! <rfc1918> port { 139, 445 }