CVE-2026-84515

CVE-2026-84515 is an out-of-bounds write (CWE-787) in the macOS kernel's SMB client code that Apple fixed with improved bounds checking. The flaw is triggered when a Mac connects to a malicious SMB file server, such as a hostile network share an attacker lures a user into mounting via a link, a spoofed NAS, or a man-in-the-middle position. Successful exploitation corrupts kernel memory, which per the CVSS 3.1 score of 7.8 (C:H/I:H/A:H) can yield kernel-level code execution and full compromise of confidentiality, integrity, and availability on the affected Mac. All users running macOS Sequoia before 15.8, macOS Tahoe before 26.7, and macOS Golden Gate before 27 are affected. No public proof-of-concept is known and the issue is not on the CISA KEV catalog, so exploitation is presumed none_known at this time.

What to do: Patch immediately: upgrade to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27, and push these updates via MDM in enterprise fleets. Instruct users not to mount SMB shares or click smb:// links from untrusted networks or unknown servers, and audit for unexpected outbound SMB (port 445) connections or auto-mounted network shares on managed devices. No workaround fully mitigates a kernel memory-corruption bug, so updating is the primary defense.