Description

A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Connecting to a malicious NFS server may lead to kernel memory corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-14T21:17:07.903Z",
  "pubdate": "2026-09-14T21:17:07.903Z",
  "executiveSummary": "A use-after-free vulnerability exists within the kernel-level Network File System (NFS) implementation across multiple Apple operating systems, including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.\nThis vulnerability allows an attacker operating a malicious NFS server to induce memory corruption within the kernel when a client attempts to connect to the compromised share.\nSuccessful exploitation of this flaw can result in arbitrary code execution with kernel-level privileges, leading to a complete compromise of the affected device’s security integrity.\nThe attack is triggered when an unsuspecting victim initiates a connection to a malicious NFS server, at which point the attacker can manipulate the interaction to trigger a use-after-free condition in the kernel’s memory management routines.\nRisk implications are severe, as kernel-level exploitation bypasses standard user-space sandboxing, enabling persistent access, data exfiltration, or complete system takeover.\nThis issue is addressed in iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 via improved memory management.",
  "technicalDetails": "The vulnerability resides in the kernel’s NFS client implementation, specifically concerning how it handles memory lifecycle management during session establishment or data exchange with a remote NFS server.\nThe root cause is a use-after-free defect, wherein the kernel allocates memory for a specific NFS-related object or control block, but subsequently attempts to access that memory address after it has been deallocated or freed.\nThe exploitation flow begins when an attacker lures or forces a target device to mount or interact with a malicious NFS server. During the protocol handshake or subsequent file operations, the server transmits specially crafted responses designed to induce unexpected state transitions in the client's NFS state machine.\nWhen the victim client receives these crafted packets, the NFS kernel driver performs actions that trigger an premature release of a memory resource while other pointers to that same memory remain active in the kernel stack or data structures.\nBy predicting or controlling the heap layout, an attacker can replace the freed memory object with malicious data before the kernel attempts to access the stale pointer. This is often achieved through heap grooming or spraying techniques to ensure the target pointer references attacker-controlled values.\nWhen the kernel dereferences this stale pointer, it treats the attacker-supplied data as a legitimate kernel object, such as a function pointer or a structure containing critical configuration data. If the attacker overwrites function pointers within the object, they can redirect kernel execution flow to arbitrary addresses, such as a ROP (Return Oriented Programming) chain or shellcode located in kernel memory.\nThe impact of this exploitation is severe, as the kernel operates at the highest privilege level (Ring 0). Once execution flow is diverted, the attacker can disable kernel protections, such as KASLR (Kernel Address Space Layout Randomization) or PAC (Pointer Authentication Codes), to gain full control over the system, bypass sandbox restrictions, and maintain long-term persistence without detection by user-level security processes.\nThe vulnerability affects multiple versions: iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27. It does not require local authentication, as the trigger is network-based, making the NFS client a high-value attack surface."
}