Executive brief
A use-after-free vulnerability in the kernel's NFS (network file system) handling allows an attacker running a malicious NFS server to corrupt kernel memory when a user or device connects to it. Successful exploitation could lead to a system crash, data corruption, or potentially arbitrary code execution with kernel-level privileges, affecting all major Apple operating systems.
Technical details
A use-after-free vulnerability exists in the kernel's NFS (Network File System) protocol handler, where freed memory is accessed after deallocation, leading to kernel memory corruption. The vulnerability is triggered by connecting to a malicious NFS server that sends crafted protocol messages. Attack requires the victim to actively connect to the attacker-controlled NFS server (network-adjacent or remote depending on network topology). Exploitation results in kernel memory corruption, potentially leading to denial of service or arbitrary code execution. Patches have been released across iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
Affected products
- Apple iOS before 26.7, 27
- Apple iPadOS before 26.7, 27
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
- Apple tvOS before 27
- Apple visionOS before 27
- Apple watchOS before 27
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched