CVE-2026-43815 is a buffer overflow in afpfs, the macOS client for Apple Filing Protocol servers. Connecting to a malicious afpfs server may lead to kernel memory corruption. The record scores it 8.8 (High). Apple lists the fixes as macOS Sequoia 15.7.8, Sonoma 14.8.8 and Tahoe 26.6.
What's affected
Apple's security notes for macOS Tahoe 26.6, released 27 July 2026, list this issue under afpfs, with the impact stated as kernel memory corruption after connecting to a malicious afpfs server. The record lists the fixes as macOS Sequoia 15.7.8, Sonoma 14.8.8 and Tahoe 26.6, and links three Apple pages. We read the Tahoe 26.6 page only, so confirm the others.
Note on dates: the CVE was published on 14 September 2026, but the Tahoe 26.6 fix shipped in July, so Macs patched since then are already covered.
Source note: Apple does not publish scores, so the 8.8 (High) is from the record only, with a network vector and user interaction.
Weakness class: CWE-787, out-of-bounds write.
How to check if you're exposed
On a Mac, choose the Apple menu, then About This Mac, and read the macOS version. You can also run sw_vers in Terminal. Then open System Settings, General, Software Update to see whether an update is waiting. For a fleet, your MDM or Jamf-style inventory can report the macOS version per device, and you can set a deadline for the update.
Compare with the fixed releases: Sequoia 15.7.8, Sonoma 14.8.8 and Tahoe 26.6. A Mac below those on its line is affected. You can also check whether anyone in your organisation still uses AFP at all, since newer file sharing mostly uses SMB.
What to do now
- Update Macs to Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6 or later.
- Tell users not to connect to unknown file servers, and disable AFP connections where your network does not need them.
- Block outbound AFP (TCP port 548) at the network edge if you do not use it.
- Check older Macs that remain on Sonoma or earlier and confirm they have the final update for their line.
- Move remaining AFP shares to SMB where you can.
Why it matters
A buffer overflow in a kernel component is among the more serious classes, because memory corruption in the kernel can lead to full system control. The record's vector is network with user interaction, which matches Apple's description of connecting to a malicious server: the user, or something acting for them, has to initiate the connection.
The user interaction requirement softens it, though it is easy for a mounted share to be reached through a link or saved connection. The KEV flag is false and Apple does not report exploitation. The fix has been available since July for most Macs, so the task is mostly confirming that devices actually installed it.
Quick check
Do I need to run an AFP server to be affected?
No. The flaw is in the client side. Connecting to a malicious server is what triggers it.
Is the fix new?
The Tahoe 26.6 release was dated 27 July 2026, though the CVE was published 14 September.
Sources
Last reviewed: 18 October 2026.
