Executive brief
A vulnerability in macOS could allow a maliciously crafted disk image to crash the system or corrupt sensitive kernel memory when mounted. This affects users who might download and open untrusted disk image files, potentially leading to a complete system failure or unauthorized access to system-level data. Apple has released updates for macOS Sequoia, Sonoma, and Tahoe to address this issue.
Technical details
An out-of-bounds read vulnerability exists in the macOS kernel's handling of disk images. The issue stems from insufficient bounds checking when mounting a disk image. An attacker can exploit this by providing a specially crafted disk image file that, when processed by the system, triggers an out-of-bounds memory access. This can result in a kernel panic (system termination) or the corruption of kernel memory. The vulnerability is addressed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6 through improved bounds checking.
Affected products
- Apple macOS Sequoia Before 15.7.8
- Apple macOS Sonoma Before 14.8.8
- Apple macOS Tahoe Before 26.6
Timeline
- 2026-07-27: advisory
- 2026-07-27: disclosed
- 2026-07-27: patched