Executive brief
A buffer overflow vulnerability in Apple macOS affects how the operating system processes disk images. When a user mounts a maliciously crafted disk image, an attacker can cause the system to crash unexpectedly or corrupt critical kernel memory that manages core system functions. This could lead to system instability, data loss, or potential privilege escalation.
Technical details
This is a buffer overflow vulnerability (CWE-120) in macOS disk image handling that was addressed with improved bounds checking. The root cause lies in the disk image mounting code (APFS or related file system components), which fails to properly validate buffer boundaries when processing maliciously crafted disk images. The attack vector is local: an attacker must trick a user into mounting a specially crafted disk image file. Successful exploitation results in out-of-bounds memory writes that can corrupt kernel memory, leading to unexpected system termination or potentially arbitrary code execution with kernel privileges. Apple patched this issue in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7