AI analysis
CVE-2026-43686 is a use-after-free vulnerability in Apple's kernel NFS client, disclosed in Apple's September 2026 mass update. It is triggered when a device connects to (mounts a share from) a malicious NFS server, which can lead to kernel memory corruption — typically enough to crash the device or potentially execute code with kernel privileges. All unpatched iPhones, iPads, Macs, Apple TVs, Vision Pro headsets, and Apple Watches are affected, though practical exploitation requires the target to actually connect to an attacker-controlled NFS server, which is uncommon for consumers and mostly plausible in enterprise/managed-network or automount scenarios. No CVSS score has been assigned, no public proof-of-concept is known, and the flaw is not in the CISA KEV catalog, with no reports of in-the-wild exploitation. The issue was fixed with improved memory management in the September 2026 OS releases.
What to do: Patch to the fixed releases: iOS/iPadOS 26.7 or 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27. Users and admins should avoid mounting NFS shares from untrusted networks or unknown servers, and enterprise teams should audit automount/NFS configuration profiles so managed devices only connect to vetted NFS infrastructure. Watch for a CVSS score and any follow-on advisory, since kernel memory corruption flaws in Apple platforms are frequently combined with other bugs in chained attacks.
Affected
| Apple iOS | fixed in iOS 26.7 and iOS 27; earlier versions affected |
| Apple iPadOS | fixed in iPadOS 26.7 and iPadOS 27; earlier versions affected |
| Apple macOS Sequoia | fixed in macOS Sequoia 15.8; earlier versions affected |
| Apple macOS Tahoe | fixed in macOS Tahoe 26.7; earlier versions affected |
| Apple macOS Golden Gate | fixed in macOS Golden Gate 27; earlier versions affected |
| Apple tvOS | fixed in tvOS 27; earlier versions affected |
| Apple visionOS | fixed in visionOS 27; earlier versions affected |
| Apple watchOS | fixed in watchOS 27; earlier versions affected |
Estimated exposure
mass≈1–2 billion active Apple devices potentially affected, but the practically exploitable subset (devices mounting NFS shares) is far smaller — likely enterprise… — Apple publicly cites roughly 2 billion active devices across iOS, iPadOS, macOS, watchOS, tvOS, and visionOS, but the attack requires a victim to connect to a malicious NFS server, a configuration most consumers never use, so realistic…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory corruption.