Executive brief
macOS includes a built-in file-sharing protocol client (SMB) used to connect to shared drives and network storage. An attacker running a malicious SMB server can trigger an out-of-bounds read in the SMB implementation, causing the system to crash unexpectedly. This affects availability and could disrupt user work, though no data theft or privilege escalation is indicated.
Technical details
An out-of-bounds read vulnerability exists in macOS's SMB (Server Message Block) client implementation. The flaw is triggered when a system connects to a malicious SMB server that sends specially crafted responses. The vulnerability allows reading memory beyond the allocated buffer bounds, leading to unexpected process or system termination. The issue was fixed by adding improved bounds checking in the SMB handling code. Network connectivity to the malicious server is required; no user interaction beyond initiating a connection is needed.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: patched: Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7
- 2026-09-14: disclosed