CVE-2026-84544: Apple macOS NFS DoS Vulnerability

CVE-2026-84544 Overview

CVE-2026-84544 is an integer overflow vulnerability [CWE-190] in Apple macOS Network File System (NFS) client processing. A malicious NFS server can trigger unexpected system termination or corrupt kernel memory when a macOS client connects to it. Apple addressed the flaw with improved input validation in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue is exploitable over the network without authentication or user interaction, and the primary impact is availability loss on affected systems.

Critical Impact
A remote, unauthenticated attacker operating a malicious NFS server can crash the macOS kernel or corrupt kernel memory of any client that connects.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-84544 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-84544

Vulnerability Analysis

The vulnerability resides in the macOS NFS client code path that parses responses from a remote NFS server. An attacker-controlled server returns crafted values that are used in arithmetic operations without adequate bounds checking. The resulting integer overflow leads to undersized allocations or miscalculated offsets in kernel memory. Downstream operations then read or write past intended boundaries, producing either an unexpected system termination or corruption of kernel memory structures. Apple's advisory describes the remediation as improved input validation, indicating the fix constrains attacker-influenced size and length fields before use.

Root Cause

The root cause is an integer overflow [CWE-190] in code that handles data returned by a remote NFS server. Size or length fields supplied by the server are used in arithmetic without validating that intermediate results remain within representable bounds. Because the affected code executes in kernel context, arithmetic errors translate directly into kernel memory safety issues.

Attack Vector

Exploitation requires a macOS client to mount or otherwise connect to an NFS export controlled by the attacker. This can be achieved through social engineering, DNS or network redirection, or by luring users onto hostile networks where an NFS server responds to client requests. No authentication is required and no user interaction is needed beyond initiating the NFS connection. Successful exploitation results in system termination or kernel memory corruption, aligning with the availability impact reflected in the CVSS vector.

No public proof-of-concept or exploit code is available for CVE-2026-84544. Technical specifics of the vulnerable arithmetic path are limited to Apple's advisory language. See the Apple Security Advisory #149035 for vendor detail.

Detection Methods for CVE-2026-84544

Indicators of Compromise

Unexpected kernel panics on macOS endpoints coinciding with NFS mount attempts or active NFS sessions.
Outbound TCP or UDP connections to port 2049 (NFS) directed at untrusted or unexpected hosts.
Panic logs referencing NFS client subsystems or memory management faults following network activity.

Detection Strategies

Monitor endpoint telemetry for mount_nfs process executions targeting external or unapproved server addresses.
Alert on macOS kernel panic events on hosts running versions prior to Sequoia 15.8 or Tahoe 26.7.
Inspect network flow data for NFS traffic (port 2049) leaving trusted network segments.

Monitoring Recommendations

Collect and centralize macOS panic.log and system.log entries for correlation with network events.
Track macOS build versions across the fleet to identify hosts still exposed to CVE-2026-84544.
Baseline expected NFS server destinations and alert on deviations.

How to Mitigate CVE-2026-84544

Immediate Actions Required

Update all macOS endpoints to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 as applicable to the installed major version.
Restrict outbound NFS traffic (port 2049) at network perimeters to known, trusted file servers only.
Audit fleet inventory to identify macOS hosts running vulnerable builds and prioritize them for patching.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to the vendor advisories for exact build numbers and applicability: Apple Security Advisory #149035, Apple Security Advisory #149042, and Apple Security Advisory #149043.

Workarounds

Block or firewall NFS client traffic to untrusted networks until patches are deployed.
Unmount and avoid connecting to NFS exports hosted outside controlled infrastructure.
Disable automatic NFS mounts on mobile macOS devices that operate on untrusted networks.

bash

# Verify installed macOS build and enumerate active NFS mounts
sw_vers
mount | grep nfs

# Example: block outbound NFS at the host firewall using pf
echo "block out proto { tcp udp } from any to any port 2049" | sudo pfctl -ef -