CVE-2026-84536

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to unexpected system termination.

Analysis

AI-generated

Technical impact

An integer underflow flaw in Apple’s macOS SMB client causes the system to terminate unexpectedly when it processes crafted SMB‑of‑service condition for the affected machine.

Affected Systems

macOS releases prior to Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 are vulnerable. Updating to these versions or newer resolves the issue.

Risk and Exploitability

The CVSS score is 6.5 and the EPSS score is below 1 %, indicating a low but non listed in the CISA KEV catalog. The likely attack vector is via the SMB protocol when a client initiates communication with a malicious server. The CVE description does not explicitly state authentication requirements, but it is inferred that no client authentication is required, meaning any SMB client could be targeted.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update macOS to the latest available version (Golden Gate 27, Sequoia 15.8, Tahoe 26.7 or newer) to apply the fix.
  • If client or block inbound and outbound SMB traffic using the system firewall.
  • Monitor network traffic for anomalous SMB packets and consider rate limiting or packet filtering to reduce exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 20:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title SMB Client Integer Underflow Leading to System Crashes
Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title SMB Client Integer Underflow Leading to System Crashes
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-190
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Description An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to unexpected system termination.
References
Earlier changes (2)
Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:35 PM
Reserved
Sep 1, 2026, 9:13 PM

View source JSON

Updated
Sep 15, 2026, 4:43 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 16, 2026, 6:02 PM

View source JSON

No data.

Updated
Sep 20, 2026, 9:00 PM

JSON