AI analysis
CVE-2026-43687 is a kernel memory disclosure flaw in Apple's NFS client caused by insufficient memory handling, patched by Apple on September 14, 2026. It is triggered when a device connects to (mounts a share from) an attacker-controlled or malicious NFS server, such as one offered by an attacker on the local network. A successful attack lets the malicious server read back portions of the device's kernel memory, which can expose sensitive data such as kernel pointers, addresses, or other information useful for further exploitation. All unpatched iPhones, iPads, Macs (Tahoe and Golden Gate), Apple TVs, Vision Pro headsets, and Apple Watches are affected. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.
What to do: Update to iOS/iPadOS 26.7 or 27, macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, which Apple shipped in its September 14 'Updates Everything' release. Until patched, avoid mounting NFS shares from untrusted servers or on untrusted networks, and enterprise admins should restrict NFS auto-mounting to known-good servers and verify fleet-wide OS updates. No workaround exists beyond avoiding malicious NFS servers.
Affected
| Apple iOS | before 26.7 (fixed in 26.7 and 27) |
| Apple iPadOS | before 26.7 (fixed in 26.7 and 27) |
| Apple macOS Golden Gate | before 27 |
| Apple macOS Tahoe | before 26.7 |
| Apple tvOS | before 27 |
| Apple visionOS | before 27 |
| Apple watchOS | before 27 |
Estimated exposure
mass≈2 billion+ devices (Apple's stated active installed base), with a small fraction practically exposed via NFS use — The vulnerable NFS client code ships in every current iPhone, iPad, Mac, Apple TV, Vision Pro, and Apple Watch, and Apple has publicly stated an active installed base of over 2 billion devices; however, the flaw only manifests when a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may disclose kernel memory.