CVE-2026-65365 in macOS
Summary
by MITRE • 09/15/2026
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB share may disclose kernel memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability described involves an out-of-bounds read condition within the Server Message Block protocol implementation on Apple operating systems, specifically affecting versions prior to macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. This flaw stems from insufficient validation of input parameters when processing SMB requests, allowing an attacker who can connect to a maliciously configured SMB share to trigger memory access operations that extend beyond the allocated buffer boundaries. In technical terms, this is classified under CWE-125, which defines out-of-bounds read as accessing memory locations outside the intended range, potentially leading to information disclosure or system instability depending on what data resides in those adjacent memory regions.
The operational impact of this vulnerability centers on the potential for kernel memory disclosure. Because the SMB service operates with high privileges within the operating system's execution environment, an out-of-bounds read can expose sensitive kernel structures, cryptographic keys, stack contents, or other privileged data to a remote attacker. This type of information leak is particularly dangerous as it provides adversaries with critical intelligence about the target system’s internal state, which can be leveraged for further exploitation steps such as bypassing security controls like ASLR or identifying specific software versions and configurations. The ability to read kernel memory effectively breaks the isolation boundary between user-space applications and core operating system components, undermining the integrity of the entire platform.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1083, which covers File and Directory Discovery, although in this context it is more accurately mapped to information gathering techniques that facilitate privilege escalation or lateral movement by exposing internal system details. The attack vector requires network connectivity to an SMB share, meaning the risk is elevated for systems exposed on local networks or potentially over the internet if SMB services are improperly configured with public access. Attackers can craft specific SMB packets designed to exploit the bounds checking deficiency, causing the kernel to return memory contents that were not intended for transmission back to the client.
Mitigation strategies primarily involve applying the vendor-provided software updates immediately upon availability. For organizations managing large fleets of macOS devices, automated patch management systems should be configured to prioritize these specific version updates across Golden Gate, Sequoia, and Tahoe releases. In environments where immediate patching is not feasible due to compatibility concerns or operational constraints, network segmentation can serve as a temporary compensating control by restricting SMB traffic to trusted subnets only. Additionally, disabling unnecessary SMB services on endpoints that do not require file sharing functionality reduces the attack surface significantly. Security monitoring solutions should be tuned to detect anomalous SMB traffic patterns indicative of exploitation attempts, such as unusually large or malformed packet sizes directed at SMB ports, although detection may remain challenging without deep packet inspection capabilities tailored for protocol-specific anomalies.