CVE-2026-65374

CVE-2026-65374 is an out-of-bounds write (memory corruption) flaw in Apple macOS's handling of WebDAV connections, rated 8.8 (high) with network vector, low attack complexity, no privileges required, but user interaction required. It is triggered when a victim connects to an attacker-controlled WebDAV server — for example by clicking a webdav:// link or mounting an untrusted WebDAV share via Finder's 'Connect to Server' — and the malformed server responses corrupt memory in the WebDAV client code. Successful exploitation can yield arbitrary code execution with the privileges of the connecting user, impacting confidentiality, integrity, and availability. All Macs running macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27 are affected; Apple addressed the issue with improved validation. No public proof-of-concept is known and the flaw is not on the CISA KEV catalog, so there is no evidence of in-the-wild exploitation at this time.

What to do: Patch to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (System Settings > Software Update), prioritizing fleets where users mount network shares. Advise users not to click webdav:// links or connect to WebDAV servers from untrusted sources, since the flaw requires user interaction. Egress/URL filtering can also block or flag webdav:// schemes and unexpected outbound WebDAV (TCP 80/443 with WebDAV methods) as a defense-in-depth measure.