CVE-2026-84537: Apple macOS Use-After-Free Vulnerability

CVE-2026-84537 Overview

CVE-2026-84537 is a memory corruption vulnerability in Apple macOS that allows a local application to cause unexpected system termination or corrupt kernel memory. The flaw is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer. Apple addressed the issue with improved memory handling in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Exploitation requires local access and low privileges but no user interaction, making it relevant for post-compromise scenarios where an attacker seeks to destabilize the host or manipulate kernel state.

Critical Impact
A local app with low privileges can corrupt kernel memory or force a system crash on unpatched macOS hosts.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84537 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84537

Vulnerability Analysis

The vulnerability resides in macOS kernel-adjacent memory handling logic. An unprivileged local application can trigger an operation that mishandles memory boundaries, leading to kernel memory corruption or an unexpected system termination (panic). The classification under [CWE-119] indicates that the affected code path fails to properly restrict operations within the bounds of an allocated buffer.

Because the corruption reaches kernel memory, successful exploitation can affect data integrity beyond the calling process. In practice, the most reliable outcome is a denial-of-service condition through kernel panic, which aligns with the high availability impact reflected in the CVSS metrics. More sophisticated exploitation attempts could shape kernel state, though Apple's advisory does not indicate confirmed code execution.

Root Cause

Apple's advisory attributes the fix to "improved memory handling," which is consistent with a buffer boundary or lifetime-management defect in a kernel or driver code path exposed to user space. The vendor has not published detailed root-cause information, and no public proof-of-concept is available.

Attack Vector

The attack vector is local. An adversary must first execute code on the target macOS system, typically through a malicious or compromised application. Once running, that application can invoke the affected interface to corrupt kernel memory or crash the host. No user interaction and no elevated privileges are required to reach the vulnerable code. Full technical details are not available; see the Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043 for vendor guidance.

Detection Methods for CVE-2026-84537

Indicators of Compromise

Unexpected kernel panics or repeated system terminations tied to a specific application launch or workload.
Panic logs under /Library/Logs/DiagnosticReports/ referencing memory access violations from recently installed or untrusted applications.
Applications making unusual syscalls or IOKit interactions immediately prior to a system crash.

Detection Strategies

Correlate crash-report telemetry with process execution history to identify applications repeatedly implicated in kernel faults.
Baseline macOS fleet crash rates and flag hosts with anomalous kernel panic frequency after new software installs.
Inventory macOS endpoints and identify those running versions earlier than macOS Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.

Monitoring Recommendations

Forward macOS unified logs and DiagnosticReports panic files to a centralized logging platform for retention and correlation.
Monitor for installation and execution of unsigned or newly introduced applications on managed macOS endpoints.
Track OS version compliance through MDM and alert on hosts that remain on vulnerable builds beyond a defined patch window.

How to Mitigate CVE-2026-84537

Immediate Actions Required

Upgrade all macOS hosts to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as appropriate for the hardware.
Restrict installation of untrusted third-party applications and enforce Gatekeeper and notarization requirements.
Audit macOS fleet inventory to identify unpatched systems and prioritize remediation on developer, admin, and high-value endpoints.

Patch Information

Apple has released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to the vendor advisories: Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043.

Workarounds

No vendor-provided workaround exists; patching is the required remediation.
Reduce exposure by limiting local user privileges and restricting application execution to signed, trusted software until patches are deployed.
Enforce MDM policies that block installation of unapproved applications on managed macOS systems.

bash

# Verify installed macOS version and check for available updates
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all --restart