CVE-2026-84544 is a high severity (CVSS 7.5) integer overflow in the macOS kernel. Connecting to a malicious NFS server may cause an unexpected system termination or corrupt kernel memory. Apple fixed it in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS. Apple's security notes place this fix in the Kernel component and describe the impact as follows: connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory. Apple says an integer overflow was addressed with improved input validation.
The CVSS vector in the record is network, low complexity, no privileges and no interaction, with a high impact on availability only. Apple's notes do not mention memory corruption beyond the sentence above, and the record scores no confidentiality or integrity impact, so the realistic outcome is a crash of the Mac.
The record says the fix shipped in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, both dated 14 September 2026, and they list this CVE. I did not fetch the page for Sequoia 15.8, so I rely on the record for that one.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update each Mac to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7, whichever your hardware and policy support.
- Use your device management tool to push the update and report which Macs have not applied it.
- Set a deadline for Macs that are overdue, and follow up with their owners.
- Keep automatic security updates switched on for personal and unmanaged Macs.
- If you use NFS, mount shares only from servers you control, and avoid automounting from unknown hosts.
Why it matters
Integer overflow, tracked as CWE-190, happens when arithmetic on a number goes past what its type can hold and wraps around. In a kernel, a length that wraps to a small value can lead to a buffer that is too small for the data that follows. That is why an integer overflow so often turns into a memory corruption bug, and why Apple's notes use that wording.
The attack needs the Mac to connect to a hostile NFS server. Networks where people mount shares from servers they do not control, or where a rogue server can be placed on the local network, have the most exposure. A kernel crash takes the whole machine down. The record does not list this CVE as exploited in the wild.
Quick check
What does an attacker need to do?
Per Apple, a Mac has to connect to a malicious NFS server. The record rates no privileges and no user interaction, but the Mac must make the connection.
Does it matter if I never use NFS?
Exposure is lower if the Mac never mounts NFS shares, but updating is still the right step, since the fix ships with routine security updates.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
