CVE-2026-84515: Apple macOS Buffer Overflow Vulnerability

CVE-2026-84515 Overview

CVE-2026-84515 is an out-of-bounds write vulnerability [CWE-787] in Apple macOS. The flaw resides in the Server Message Block (SMB) client. Connecting a vulnerable Mac to a malicious SMB server can trigger kernel memory corruption. Apple addressed the issue with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The vulnerability requires local access with low privileges and no user interaction beyond initiating the SMB connection. Successful exploitation can compromise confidentiality, integrity, and availability of the kernel.

Critical Impact
An attacker who controls an SMB server reachable by the victim can corrupt kernel memory on the connecting macOS host, potentially leading to kernel-level code execution or system compromise.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia prior to 15.8
Apple macOS Tahoe prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84515 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84515

Vulnerability Analysis

The vulnerability is an out-of-bounds write in the macOS SMB client code path. When the client parses responses from an SMB server, insufficient bounds checking allows attacker-controlled data to be written past the intended kernel buffer boundary. Because the SMB client runs in kernel context, memory corruption directly affects kernel data structures.

An attacker who convinces a user to mount or connect to a malicious SMB share can trigger the vulnerable code path. The malformed server response overflows the target buffer and corrupts adjacent kernel memory.

Root Cause

The defect stems from missing or inadequate size validation on data received from the SMB server before it is written to a kernel buffer. Apple's advisory notes the fix consists of improved bounds checking, indicating the length field or record size supplied by the remote server was trusted without proper validation against the destination buffer.

Attack Vector

Exploitation requires a victim macOS host to connect to an SMB server controlled by the attacker. This can occur through user-initiated share mounting, smb:// URLs delivered via phishing, or malicious network resources on shared infrastructure. Once the connection is established, the attacker returns crafted SMB protocol messages that trigger the out-of-bounds write in the kernel client. No verified public exploit or proof-of-concept is available as of publication.

No verified proof-of-concept code is available. Refer to the Apple Support Article #149035, #149042, and #149043 for vendor details.

Detection Methods for CVE-2026-84515

Indicators of Compromise

Unexpected outbound SMB (TCP 445) connections from macOS endpoints to untrusted or external hosts.
Kernel panic logs referencing SMB client components (smbfs, com.apple.filesystems.smbfs) on affected macOS versions.
User-initiated mounts of smb:// URLs originating from email, chat, or browser link handling.

Detection Strategies

Inventory macOS endpoints and flag hosts running versions earlier than macOS Sequoia 15.8, Tahoe 26.7, or Golden Gate 27.
Monitor endpoint telemetry for mount_smbfs process executions targeting non-corporate SMB hosts.
Correlate crash reports and kernel panic diagnostics with recent SMB session activity to identify potential exploitation attempts.

Monitoring Recommendations

Log SMB session establishment events at network egress and alert on connections to external IPs from macOS assets.
Collect and centralize /Library/Logs/DiagnosticReports/ panic files for retrospective analysis.
Track patch compliance for the three fixed macOS branches and alert on drift.

How to Mitigate CVE-2026-84515

Immediate Actions Required

Upgrade macOS endpoints to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 as appropriate for the deployed release train.
Restrict outbound SMB traffic (TCP 445) at the network perimeter to trusted internal file servers only.
Educate users to avoid clicking untrusted smb:// links and to decline unexpected share mount prompts.

Patch Information

Apple has released fixed versions addressing this vulnerability. Consult the vendor advisories: Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Apply the update corresponding to each host's macOS major version.

Workarounds

Block outbound TCP 445 and 139 at network egress where SMB use is not required.
Disable automatic mounting of SMB shares from untrusted sources in managed configuration profiles.
Use MDM policies to prevent handling of smb:// URL schemes from browsers and mail clients.

bash

# Verify installed macOS version and patch status
sw_vers
# Expected output should show ProductVersion 15.8, 26.7, or 27 (or later)

# Block outbound SMB at the host firewall using pfctl (example)
echo "block out proto tcp from any to any port 445" | sudo pfctl -ef -