Use-After-Free in Apple macOS SMB Client Crashes Macs via Malicious Network Share
AI analysis
CVE-2026-43719 is a use-after-free flaw (CWE-416) in the way macOS handles SMB network shares, addressed by Apple with improved memory management. An attacker triggers it by convincing a user to mount a maliciously crafted SMB share — for example through an smb:// link or an attacker-controlled file server on the network — and successful exploitation causes the affected Mac to terminate (a crash or kernel-level denial of service). The CVSS 3.1 vector (6.5, A:H) shows the impact is availability only, with no indicated path to code execution or data theft, though a repeatable crash gives a reliable remote DoS against any user who mounts the share. The flaw affects macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27, and the vulnerable SMB client ships in standard macOS installs. It was fixed as part of a record-setting Apple patch batch; no public proof of concept or in-the-wild exploitation is known, and it is not on the CISA KEV list.
What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > General > Software Update. Instruct users not to mount SMB shares from untrusted servers and to be cautious with unsolicited smb:// links that prompt to connect. Admins should treat this patch batch — reported as record-setting in size — as a priority rollout and verify update compliance across their Mac fleets.
Affected
| Apple macOS Sequoia | prior to 15.8 (fixed in 15.8) |
| Apple macOS Tahoe | prior to 26.7 (fixed in 26.7) |
| Apple macOS Golden Gate | prior to 27 (fixed in 27) |
Estimated exposure
mass≈100M+ Macs (the vulnerable SMB client ships in every default macOS install) — Apple's active Mac installed base is commonly estimated above 100 million devices, and the SMB mount-handling code is present in default installs, though triggering requires user interaction (UI:R), which limits practically exploitable…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted SMB network share may lead to system termination.