CVE-2026-84549 is a high severity (CVSS 7.5) out-of-bounds read in the macOS kernel. Connecting to a malicious NFS server may cause an unexpected system termination or corrupt kernel memory. Apple fixed it in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
The record covers macOS. Apple lists this one under the Kernel component and describes the impact as follows: connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory. Apple says an out-of-bounds read was addressed with improved bounds checking.
It sits next to CVE-2026-84544 in Apple's notes, with the same impact sentence and a different cause. That one is an integer overflow. This one is a read past the end of a buffer. Both are fixed in the same updates. The CVSS vector in the record is network, low complexity, no privileges and no interaction, with a high availability impact only.
The record says the fix shipped in macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7. I read Apple's pages for Golden Gate 27 and Tahoe 26.7, both dated 14 September 2026, and they list this CVE. I did not fetch the page for Sequoia 15.8, so I rely on the record for that one.
How to check if you're exposed
Check the macOS version on each Mac:
sw_vers -productVersion
You can also open System Settings, go to General, then Software Update, and see whether an update is offered. For a fleet, read the version from your device management inventory and compare it with the fixed releases: Golden Gate 27, Sequoia 15.8 or Tahoe 26.7. A Mac on an older point release of the same major version is affected until it updates.
Apple's pages also give the list of devices each release covers. If a Mac is too old to run any of the fixed releases, plan its retirement or restrict what it can do, since it will not get this fix.
What to do now
- Update each Mac to macOS Golden Gate 27, Sequoia 15.8 or Tahoe 26.7, whichever your hardware and policy support.
- Use your device management tool to push the update and report which Macs have not applied it.
- Set a deadline for Macs that are overdue, and follow up with their owners.
- Keep automatic security updates switched on for personal and unmanaged Macs.
- Review which Macs mount NFS shares and from which servers, and remove mounts that are no longer needed.
Why it matters
An out-of-bounds read, tracked as CWE-125, means code reads memory outside the buffer it is meant to read. In a kernel, that can mean a crash, which is the outcome the vector rates. Apple's wording also mentions kernel memory corruption, though the record scores no integrity impact.
Two kernel NFS flaws with the same trigger point to a client code path that deserved a review, and Apple has made the fix in the same release. The takeaway for defenders is practical: a Mac that mounts shares from servers you do not control should be updated first. The record does not list this CVE as exploited in the wild.
Quick check
How is this different from CVE-2026-84544?
Both involve a malicious NFS server and the kernel. This one is an out-of-bounds read, the other is an integer overflow. One update fixes both.
Is a network attack possible without any user action?
The vector says no user interaction, but the Mac has to connect to the malicious server, which usually follows from a mount.
Sources
- Apple: About the security content of macOS Golden Gate 27
- Apple: About the security content of macOS Tahoe 26.7
Last reviewed: 18 October 2026.
