Technical impact
Apple identified a use‑after‑free flaw that can corrupt kernel memory when a device connects to a malicious NFS server. The vulnerability is triggered by improper memory management, which can allow an attacker to influence kernel state and potentially run arbitrary code with elevated privileges. The risk is significant because it occurs at the kernel level, affecting system integrity, confidentiality, and CVSS score is 8.8, indicating high severity and significant impact on system integrity. The EPSS score is < 1 %, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploits yet. The likely attack vector is remote via a rogue NFS server, which could be delivered over an open network. Until a patch is applied, systems remain at risk of privilege escalation or denial of service.
Affected Systems
The flaw affects Apple iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS, all of which are vulnerable when connecting to an untrusted NFS server.
Risk and Exploitability
The vulnerability can be triggered by connecting to an untrusted NFS server, which triggers a use‑after‑free that corrupts kernel memory. The CVSS score of 8.8 indicates high severity, meaning successful exploitation could allow arbitrary code execution as the kernel. The EPSS score of < 1 % shows a low but non‑zero probability of exploitation, and the vulnerability is not yet listed in CISA KEV, so no publicly known exploits are documented. Attackers would need remote access to the victim device to act as an NFS client and communicate with a malicious NFS server, making the vector network‑based but not requiring local privileges.
