CVE-2026-43687

CVE-2026-43687 is a kernel memory disclosure flaw in Apple's NFS client caused by insufficient memory handling, patched by Apple on September 14, 2026. It is triggered when a device connects to (mounts a share from) an attacker-controlled or malicious NFS server, such as one offered by an attacker on the local network. A successful attack lets the malicious server read back portions of the device's kernel memory, which can expose sensitive data such as kernel pointers, addresses, or other information useful for further exploitation. All unpatched iPhones, iPads, Macs (Tahoe and Golden Gate), Apple TVs, Vision Pro headsets, and Apple Watches are affected. There is no CVSS score yet, no public proof of concept, and no known exploitation in the wild.

What to do: Update to iOS/iPadOS 26.7 or 27, macOS Tahoe 26.7 or macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, which Apple shipped in its September 14 'Updates Everything' release. Until patched, avoid mounting NFS shares from untrusted servers or on untrusted networks, and enterprise admins should restrict NFS auto-mounting to known-good servers and verify fleet-wide OS updates. No workaround exists beyond avoiding malicious NFS servers.