CVE-2026-84509: Apple macOS Buffer Overflow Vulnerability

CVE-2026-84509 Overview

CVE-2026-84509 is an out-of-bounds read vulnerability [CWE-125] in Apple macOS that Apple resolved with improved bounds checking. The flaw resides in the Server Message Block (SMB) client component. Connecting to a malicious SMB server may cause unexpected system termination, resulting in a denial of service. Apple addressed the issue across macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability is exploitable over the network and requires user interaction to initiate the SMB connection to an attacker-controlled server.

Critical Impact
A malicious SMB server can trigger an out-of-bounds read in the macOS SMB client, causing unexpected system termination and impacting host availability.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84509 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84509

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the macOS SMB client. When a macOS host connects to a remote SMB server, the client parses server-supplied protocol data. A crafted response from a malicious server causes the client to read memory beyond the intended buffer boundaries. The invalid read leads to unexpected system termination, producing a denial-of-service condition on the connecting host. Apple's advisories describe the fix as improved bounds checking, indicating the pre-patch code path lacked adequate validation of a length or index derived from attacker-controlled input.

Root Cause

The root cause is missing or insufficient validation of size or offset fields within data returned by an SMB server. The SMB client trusts these values when computing memory access ranges, allowing a read past the end of an allocated buffer. Apple resolved the defect by adding bounds checks before the affected read operations.

Attack Vector

An attacker must operate or control an SMB server reachable by the victim. The victim must initiate an SMB connection, for example through Finder, the mount_smbfs command, or an smb:// URL. Once the connection is negotiated, the attacker returns crafted protocol data that triggers the out-of-bounds read. Exploitation impacts availability only; the advisory does not indicate confidentiality or integrity impact. No public proof-of-concept, exploit code, or evidence of exploitation in the wild is available. See the Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor details.

Detection Methods for CVE-2026-84509

Indicators of Compromise

Unexpected macOS kernel panics or reboots correlated with outbound SMB (TCP/445) connections to untrusted hosts.
Panic logs in /Library/Logs/DiagnosticReports/ referencing SMB client components such as smbfs or com.apple.filesystems.smbfs.
Recent user interaction with smb:// URLs, Finder "Connect to Server" events, or mount_smbfs invocations preceding a crash.

Detection Strategies

Alert on outbound SMB sessions from macOS endpoints to destinations outside sanctioned file-server ranges.
Correlate crash reports and endpoint telemetry with SMB negotiation traffic to identify server-triggered failures.
Monitor for repeated system terminations across macOS hosts sharing a common remote SMB destination.

Monitoring Recommendations

Ingest macOS diagnostic reports and unified logs into a centralized log platform to spot SMB-related panics.
Track macOS build versions across the fleet to verify hosts are running Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 or later.
Baseline expected SMB destinations and flag connections to new external hosts on TCP/445.

How to Mitigate CVE-2026-84509

Immediate Actions Required

Apply the Apple security updates: upgrade to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7.
Prioritize patching for macOS endpoints that mount SMB shares or handle smb:// links from external sources.
Instruct users to avoid connecting to unknown or untrusted SMB servers until patches are installed.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for the full advisory content and affected build numbers.

Workarounds

Block outbound TCP/445 traffic at the perimeter to prevent macOS clients from reaching untrusted external SMB servers.
Restrict SMB mounts to approved internal file servers using endpoint configuration profiles or firewall rules.
Disable automatic handling of smb:// URLs in browsers and mail clients where feasible.

bash

# Verify installed macOS version against patched builds
sw_vers

# Block outbound SMB at the host firewall (example using pf)
echo "block drop out proto tcp to any port 445" | sudo pfctl -ef -