CVE-2026-84543: Apple macOS Buffer Overflow Vulnerability

CVE-2026-84543 Overview

CVE-2026-84543 is an out-of-bounds access vulnerability in the Server Message Block (SMB) client component of Apple macOS. Connecting to a malicious SMB server can trigger unexpected system termination or corrupt kernel memory. Apple addressed the flaw with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue is tracked under [CWE-125] Out-of-Bounds Read and is exploitable over the network without authentication or user interaction.

Critical Impact
A remote attacker operating a malicious SMB server can corrupt kernel memory on a connecting macOS host, causing system crashes and potentially undermining kernel integrity.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84543 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84543

Vulnerability Analysis

The vulnerability resides in the macOS SMB client code path that parses responses from a remote SMB server. When the client processes a crafted server response, it reads beyond the bounds of an allocated buffer in kernel space. The read touches memory that the SMB parser was never intended to access.

Because the affected code runs in the kernel, out-of-bounds access can dereference invalid pointers, panic the system, or expose adjacent kernel memory to further corruption. Apple's fix introduces improved bounds checking on the untrusted server-supplied length or offset fields before the read occurs.

Root Cause

The root cause is missing or insufficient validation of size and offset values received from an SMB server. Trusting attacker-controlled fields allows the client to compute a read location outside the intended buffer. This class of bug is catalogued as [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires a target macOS host to initiate an SMB connection to an attacker-controlled server. The attacker does not need credentials on the target or any user interaction beyond the initial connection. Common triggers include clicking smb:// links, mounting a share, or automatic reconnection to a previously used share hosted on a compromised network. The attack is fully network-based and unauthenticated.

No public proof-of-concept has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for vendor-supplied technical context.

Detection Methods for CVE-2026-84543

Indicators of Compromise

Unexpected kernel panics on macOS endpoints referencing the smbfs or com.apple.filesystems.smbfs kext in the panic log.
Outbound SMB (TCP/445) connections from macOS hosts to untrusted or unexpected external IP addresses.
Repeated SMB session teardowns followed by system reboots on the same endpoint.

Detection Strategies

Monitor macOS diagnostic reports under /Library/Logs/DiagnosticReports/ for kernel panics tied to the SMB client.
Alert on macOS hosts initiating SMB connections to IPs outside the corporate file-server allowlist.
Correlate crash events with preceding network flows to identify SMB server addresses that consistently precede system terminations.

Monitoring Recommendations

Ingest macOS unified log data and network flow telemetry into a central analytics platform for cross-correlation.
Track macOS version inventory to identify hosts still running versions prior to Sequoia 15.8, Tahoe 26.7, or Golden Gate 27.
Baseline normal SMB server destinations per user and flag anomalous new destinations.

How to Mitigate CVE-2026-84543

Immediate Actions Required

Apply the Apple security updates to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 on all managed endpoints.
Restrict outbound TCP/445 and TCP/139 at perimeter and endpoint firewalls to known internal file servers.
Audit MDM policies and login items for automatic SMB share mounts pointing at external hosts.

Patch Information

Apple has released fixes with improved bounds checking in the SMB client. Consult Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for the specific update packages that address CVE-2026-84543.

Workarounds

Block outbound SMB traffic to untrusted networks until patches are deployed.
Disable automatic mounting of user-supplied SMB shares via configuration profiles.
Educate users to avoid clicking smb:// URLs from untrusted sources such as email or chat messages.

bash

# Verify installed macOS version to confirm patch level
sw_vers -productVersion

# Example: block outbound SMB egress with pf on macOS
# /etc/pf.anchors/com.smbblock
block drop out proto tcp from any to any port {139, 445}

# Load the anchor
sudo pfctl -f /etc/pf.conf -e