Executive brief
Apple's Network File System (NFS) implementation in iOS, iPadOS, and macOS contains a flaw that can leak sensitive kernel memory when connecting to a malicious NFS server. An attacker running a rogue NFS server on a network could intercept users who connect to it and extract kernel data, potentially revealing system addresses and other sensitive information useful for further attacks.
Technical details
This vulnerability is a kernel memory disclosure flaw in Apple's NFS (Network File System) client implementation. The root cause stems from improper memory handling when processing NFS server responses, allowing an attacker controlling a malicious NFS server to read kernel memory by crafting specific NFS protocol messages. The attack requires a user to initiate an NFS connection to the attacker-controlled server (adjacent network vector with user interaction), but no authentication is needed on the NFS service itself. Successful exploitation results in disclosure of sensitive kernel memory contents, including kernel addresses and other data useful for defeating ASLR and kernel hardening mechanisms. The vulnerability has been patched with improved memory handling in iOS 26.7 and later, iPadOS 26.7 and later, iOS 27 and later, iPadOS 27 and later, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
Affected products
- Apple iOS before 26.7, before 27
- Apple iPadOS before 26.7, before 27
- Apple macOS Golden Gate before 27
- Apple macOS Tahoe before 26.7
- Apple tvOS before 27
- Apple visionOS before 27
- Apple watchOS before 27
Timeline
- 2026-09-14: disclosed: CVE-2026-43687 published; patches released for multiple Apple platforms
- 2026-09-14: patched: Fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27