Executive brief
macOS includes a file system driver that handles exFAT volumes, which are commonly used on external storage devices. A maliciously crafted exFAT volume can trigger a memory read error in this driver, causing the system to crash unexpectedly or potentially leak kernel memory contents to an attacker. An attacker with the ability to provide a physical storage device or network-mounted volume could exploit this to disrupt operations or access sensitive kernel data.
Technical details
An out-of-bounds read vulnerability exists in Apple's exFAT volume mounting code, caused by insufficient input validation when parsing maliciously crafted exFAT filesystem metadata. The vulnerability is triggered when a user mounts an attacker-controlled exFAT volume, requiring no authentication or privileged access beyond the ability to mount filesystems. Exploitation can result in kernel memory disclosure or unexpected kernel termination (denial of service). The issue is fixed in macOS Golden Gate 27 with improved input validation. Attack vector is local, requiring the victim to mount a malicious volume.
Affected products
- Apple macOS Golden Gate prior to 27
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: macOS Golden Gate 27