CVE-2026-84565 Overview
CVE-2026-84565 is an out-of-bounds read vulnerability [CWE-125] affecting Apple macOS disk image processing. Processing a maliciously crafted disk image can lead to unexpected application termination. Apple addressed the flaw with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
The vulnerability requires local access and user interaction, such as opening or mounting a crafted disk image. Exploitation does not require privileges, but the impact is limited to denial of service through application termination rather than code execution.
Critical Impact
A crafted disk image can trigger an out-of-bounds read in macOS, causing the processing application to terminate unexpectedly and disrupting availability of affected workflows.
Affected Products
- Apple macOS versions prior to macOS Golden Gate 27
- Apple macOS versions prior to macOS Sequoia 15.8
- Apple macOS versions prior to macOS Tahoe 26.7
Discovery Timeline
- 2026-09-14 - CVE-2026-84565 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-84565
Vulnerability Analysis
The vulnerability is an out-of-bounds read [CWE-125] in the macOS disk image processing subsystem. When a user mounts or opens a maliciously crafted disk image, the parser reads memory beyond the intended buffer boundary. The read of unintended memory causes the handling process to terminate unexpectedly.
Apple's advisory describes the fix as improved bounds checking, indicating that specific length or offset fields within the disk image structure were not properly validated before use. The vulnerability is scored for local attack vector with required user interaction, reflecting that a user must open the crafted image for exploitation to occur.
Impact is limited to availability. There is no evidence of information disclosure or code execution paths documented in the advisory. Apple published guidance across three support articles corresponding to the three fixed macOS trains.
Root Cause
The root cause is insufficient validation of length or offset fields inside disk image metadata. The parser trusts attacker-controlled values and reads past the end of an allocated buffer. Improved bounds checking, added in the patched releases, rejects malformed structures before the out-of-bounds access occurs.
Attack Vector
An attacker delivers a crafted disk image file, such as a .dmg, through email attachments, web downloads, or removable media. When a local user opens or mounts the image, the vulnerable parser processes the malformed structure. The resulting out-of-bounds read terminates the handling application.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Apple Support Article 149035 for vendor guidance.
Detection Methods for CVE-2026-84565
Indicators of Compromise
- Unexpected termination of diskimages-helper, hdiutil, or Finder processes shortly after a user opens a disk image.
- Crash reports in ~/Library/Logs/DiagnosticReports/ referencing disk image frameworks with EXC_BAD_ACCESS signatures.
- Delivery of .dmg, .sparseimage, or .sparsebundle files from untrusted sources through email or web downloads.
Detection Strategies
- Monitor endpoint telemetry for repeated crashes of disk image handling processes across multiple hosts.
- Alert on disk image files originating from external sources being mounted on managed macOS endpoints.
- Correlate crash events with recent file downloads or removable media insertion to identify targeted delivery attempts.
Monitoring Recommendations
- Collect and centralize macOS ReportCrash and spindump logs for analytics on parser crashes.
- Track macOS build versions across the fleet to identify hosts still running vulnerable releases.
- Inspect email and web gateways for disk image attachments and apply reputation-based filtering.
How to Mitigate CVE-2026-84565
Immediate Actions Required
- Update affected macOS endpoints to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 as appropriate for the installed train.
- Instruct users to avoid opening disk image files received from untrusted sources until patching is complete.
- Inventory endpoints running vulnerable macOS builds and prioritize patch deployment for high-risk users.
Patch Information
Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043 for release-specific details and download instructions.
Workarounds
- Block or quarantine disk image attachments at email and web gateways where operationally feasible.
- Restrict mounting of disk images from removable media using mobile device management (MDM) policies.
- Enforce user awareness training to reject unsolicited .dmg files from unknown senders.
# Verify installed macOS build version
sw_vers
# List recent crash reports for disk image helpers
ls -lt ~/Library/Logs/DiagnosticReports/ | grep -iE 'diskimage|hdiutil'
# Trigger a software update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
