CVE-2026-84512: Apple macOS Buffer Overflow Vulnerability

CVE-2026-84512 Overview

CVE-2026-84512 is a buffer overflow vulnerability [CWE-120] in Apple macOS disk image handling. Mounting a maliciously crafted disk image can trigger unexpected system termination or corrupt kernel memory. Apple addressed the flaw with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability affects the kernel-adjacent code path that parses disk image structures during mount operations. Successful exploitation requires user interaction to mount the crafted image, but the resulting memory corruption can compromise kernel integrity.

Critical Impact
A crafted disk image can corrupt kernel memory or cause system termination, enabling potential kernel-level compromise on unpatched macOS hosts.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84512 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84512

Vulnerability Analysis

The vulnerability resides in the macOS disk image mounting subsystem. When macOS parses a disk image, insufficient bounds checking on structure fields allows attacker-controlled data to overflow a buffer. The overflow occurs in a privileged execution context associated with kernel memory, which is why corruption of kernel memory is a documented outcome.

A successful mount of a malformed image can terminate the operating system or overwrite adjacent kernel structures. Depending on which structures are overwritten, an attacker may gain the ability to influence kernel control flow. Apple's fix introduces improved bounds validation before the affected copy operation executes.

Root Cause

The root cause is a classic buffer overflow [CWE-120]: the disk image parser copies untrusted length-prefixed or structured data into a fixed-size destination without validating that the source length fits the destination. Because the parser runs with kernel-level trust when servicing mount requests, memory writes beyond the destination bounds land in kernel-owned memory.

Attack Vector

The attack vector requires an attacker to deliver a crafted disk image (.dmg or similar) and convince a user to mount it. Delivery paths include phishing attachments, drive-by download of image files, and shared removable media. Once the user opens or double-clicks the image, macOS mounts it automatically and triggers the vulnerable parser. No additional privileges are required from the victim.

No public proof-of-concept or exploit code is available for CVE-2026-84512 at the time of publication. See the Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 for vendor technical detail.

Detection Methods for CVE-2026-84512

Indicators of Compromise

Unexpected kernel panics or system restarts shortly after a .dmg or disk image mount event
diskimages-helper or hdiutil invocations processing images sourced from email, browser downloads, or removable media
Newly delivered disk image files with anomalous size, unusual internal structures, or malformed headers

Detection Strategies

Correlate disk image mount events with subsequent process crashes or kernel panic logs in /Library/Logs/DiagnosticReports/
Alert on execution of hdiutil attach against images originating from untrusted download paths such as ~/Downloads or email attachment quarantine locations
Inspect endpoint telemetry for disk image files with hashes not previously observed in the environment being mounted by user sessions

Monitoring Recommendations

Enable and forward macOS Unified Log entries for com.apple.diskimages and kernel subsystems to a central log platform
Track macOS build versions across the fleet and flag hosts running builds below Sequoia 15.8, Tahoe 26.7, or Golden Gate 27
Monitor Gatekeeper and XProtect events alongside mount activity to identify suspicious image files evading quarantine

How to Mitigate CVE-2026-84512

Immediate Actions Required

Deploy Apple's security updates for macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 across all managed endpoints
Instruct users to avoid mounting disk images from untrusted email, messaging, or web sources until patching completes
Prioritize patch deployment for developer workstations and privileged administrator systems that routinely handle disk images

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 for release notes and specific build identifiers. Apply updates through Software Update or your mobile device management (MDM) tooling.

Workarounds

Block inbound .dmg, .iso, and related disk image attachments at email and web gateways where operationally feasible
Use MDM configuration profiles to restrict mounting of disk images from removable or untrusted volumes
Enforce user awareness policies that require verification of image source before mounting

bash

# Verify installed macOS build meets patched versions
sw_vers -productVersion
sw_vers -buildVersion

# Trigger managed software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart