CVE-2026-84536: Apple macOS SMB DOS Vulnerability

CVE-2026-84536 Overview

CVE-2026-84536 is an integer underflow vulnerability [CWE-190] affecting Apple macOS Server Message Block (SMB) client handling. An attacker operating a malicious SMB server can trigger unexpected system termination when a macOS host connects to it. The flaw stems from insufficient input validation during SMB message processing, which Apple addressed with improved bounds checking.

Apple resolved the issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vulnerability requires user interaction to exploit, as a victim must initiate the SMB connection to attacker-controlled infrastructure.

Critical Impact
A remote malicious SMB server can cause denial of service via unexpected system termination on unpatched macOS clients.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84536 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84536

Vulnerability Analysis

The vulnerability resides in the macOS SMB client code path that parses server responses. An integer underflow occurs when specifically crafted values in an SMB message are subtracted without validation, wrapping the result below zero into a large unsigned quantity. That corrupted value then influences downstream buffer or length calculations, driving the kernel into an inconsistent state that terminates the system.

Exploitation requires the victim to connect to an attacker-controlled SMB server. This can occur through direct user action, embedded smb:// links, or automated mounting workflows on the target host. No authentication or elevated privileges on the victim system are required for the malicious server to send the triggering response.

Apple's advisories confirm the fix consists of improved input validation on the affected fields, preventing the underflow condition. Refer to Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043 for vendor detail.

Root Cause

The root cause is an unchecked arithmetic operation on a length or offset field derived from untrusted SMB server input. When the operand exceeds an expected upper bound, subtraction produces an underflow classified under [CWE-190] Integer Overflow or Wraparound.

Attack Vector

The attack vector is network-based with required user interaction. An attacker hosts a malicious SMB server and induces a macOS user to connect using standard SMB URIs or file-sharing prompts. The malicious response triggers the underflow and causes system termination.

No verified public proof-of-concept code is available at this time. Consult the linked Apple advisories for technical remediation notes.

Detection Methods for CVE-2026-84536

Indicators of Compromise

Unexpected macOS kernel panics or system restarts on hosts shortly after initiating an outbound SMB connection.
Outbound TCP connections on port 445 to unfamiliar or non-corporate SMB servers.
Recent smb:// URL handoffs from browsers, email clients, or messaging applications preceding a crash.

Detection Strategies

Correlate macOS crash reports and kernel panic logs with recent SMB session establishment events.
Inspect network telemetry for macOS endpoints connecting to external SMB endpoints outside sanctioned file-share infrastructure.
Alert on macOS endpoints running versions prior to Sequoia 15.8, Tahoe 26.7, or Golden Gate 27 that still initiate SMB traffic.

Monitoring Recommendations

Ingest macOS DiagnosticReports and unified logs into a centralized platform to identify repeated abnormal terminations.
Monitor firewall and DNS logs for outbound SMB connections to internet-based hosts, which are rare in most enterprises.
Track macOS software version inventory to prioritize unpatched hosts for follow-up.

How to Mitigate CVE-2026-84536

Immediate Actions Required

Update all affected macOS systems to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 as applicable to the installed release line.
Block outbound TCP port 445 to untrusted external networks at the perimeter firewall.
Educate users to avoid clicking smb:// links from untrusted sources.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Patch details are documented in Apple Support Document 149035, Apple Support Document 149042, and Apple Support Document 149043.

Workarounds

Restrict SMB client usage to internal, trusted file servers by enforcing egress filtering on TCP/445.
Disable automatic mounting of remote SMB shares in managed configuration profiles until patching is complete.
Remove or disable protocol handlers that automatically invoke SMB from untrusted content sources.

bash

# Verify installed macOS version to confirm patch status
sw_vers -productVersion

# Example: block outbound SMB (port 445) using pf on macOS
# /etc/pf.anchors/block-smb
block drop out proto tcp from any to any port 445