CVE-2026-84588: Apple macOS Golden Gate Buffer Overflow Flaw

CVE-2026-84588 Overview

CVE-2026-84588 is a memory corruption vulnerability in Apple macOS that Apple addressed by removing the vulnerable code. The flaw resides in the disk image mounting subsystem. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory. Apple fixed the issue in macOS Golden Gate 27.

The underlying weakness is classified as an out-of-bounds write [CWE-787]. Exploitation requires user interaction, since the victim must mount the crafted image. Successful exploitation impacts system availability and can destabilize the kernel.

Critical Impact
A crafted disk image can trigger kernel memory corruption on unpatched macOS systems, leading to system termination and potential kernel state compromise.

Affected Products

Apple macOS versions prior to macOS Golden Gate 27
Systems processing untrusted disk image (.dmg) files
Endpoints where users can mount external or downloaded images

Discovery Timeline

2026-09-14 - CVE-2026-84588 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84588

Vulnerability Analysis

The vulnerability is a memory corruption issue in the macOS disk image handling code path. When a user mounts a specially crafted disk image, malformed structures within the image trigger an out-of-bounds write in kernel memory. The write can either terminate the system unexpectedly or corrupt adjacent kernel data structures.

Apple's advisory states that the fix removes the vulnerable code entirely rather than adding validation. This suggests the affected functionality was legacy or optional parsing logic that could be excised without regression. Refer to the Apple Support Article for vendor-provided details.

Root Cause

The root cause is an out-of-bounds write [CWE-787] in the kernel-mode disk image parser. Malformed fields in the disk image header or metadata sections cause the parser to write beyond an allocated buffer boundary. Because the parsing occurs in kernel context, the write directly affects kernel memory integrity.

Attack Vector

An attacker must deliver a crafted disk image to a target user and convince them to mount it. Delivery vectors include phishing attachments, malicious downloads, watering-hole sites, and removable media. On macOS, mounting can occur through Finder double-click, hdiutil attach, or automatic handlers for downloaded archives. The attack does not require prior authentication on the target system.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is low, reflecting no current evidence of in-the-wild exploitation.

Detection Methods for CVE-2026-84588

Indicators of Compromise

Unexpected kernel panics correlated with recent .dmg mount events in system logs
diskimages-helper or hdiutil process activity involving disk images from untrusted sources such as web downloads or email attachments
Presence of unsigned or unusually structured disk image files in user download directories

Detection Strategies

Monitor unified logs for diskarbitrationd and diskimages-helper errors preceding kernel panics
Alert on execution of hdiutil attach against files originating from browser or mail quarantine locations
Correlate panic reports in /Library/Logs/DiagnosticReports/ with disk image mount telemetry

Monitoring Recommendations

Ingest macOS endpoint telemetry into a centralized data lake for cross-host correlation of mount events and kernel faults
Track file provenance for .dmg, .iso, and .sparseimage files using quarantine extended attributes
Establish a baseline for legitimate disk image mount activity to surface anomalous mounts by user or host

How to Mitigate CVE-2026-84588

Immediate Actions Required

Upgrade affected macOS endpoints to macOS Golden Gate 27 or later without delay
Block delivery of .dmg attachments at the email gateway where business need does not exist
Instruct users not to mount disk images received from untrusted senders or downloaded from unverified sources

Patch Information

Apple fixed CVE-2026-84588 in macOS Golden Gate 27 by removing the vulnerable code path. Administrators should deploy the update through Software Update, Apple Business Manager, or their mobile device management (MDM) solution. Full details are available in the Apple Support Article.

Workarounds

Restrict user permissions to mount disk images through MDM configuration profiles where feasible
Enforce Gatekeeper and File Quarantine policies to prompt users before opening downloaded images
Use browser and email filtering to strip or sandbox disk image attachments pending patch deployment

bash

# Verify installed macOS version
sw_vers -productVersion

# Trigger a software update check via MDM or locally
sudo softwareupdate --list
sudo softwareupdate --install --all --restart