Description

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting a malicious disk image may cause unexpected system termination.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T21:17:10.687Z",
  "pubdate": "2026-09-14T21:17:10.687Z",
  "executiveSummary": "An out-of-bounds write vulnerability has been identified within macOS disk image handling processes. This memory corruption flaw allows a local attacker to cause unexpected system termination, effectively triggering a denial-of-service state.\nThe vulnerability affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. It stems from improper validation of input during the mounting process of a maliciously crafted disk image.\nExploitation requires a user to perform an action, specifically mounting a malicious disk image, which provides the necessary trigger for the flawed code path. Successful exploitation does not inherently grant the attacker elevated privileges, but it compromises system stability by forcing a kernel or system process crash.\nGiven the nature of disk image handling in macOS, the vulnerability presents a risk to users who may interact with untrusted storage media or downloaded disk image files. The attack requires no prior authentication once the user mounts the target file, making it a significant vector for local stability disruption.",
  "technicalDetails": "The vulnerability is characterized as an out-of-bounds (OOB) write, arising from insufficient bounds checking during the parsing or mounting of disk image structures. In the context of filesystem drivers or disk image mounting services within the kernel or user-space daemon, the software fails to adequately validate the dimensions or integrity of metadata contained within the disk image header.\nThe root cause resides in the logic that handles disk image geometry and structure allocation. When the system parses the disk image, it performs memory operations based on values read directly from the untrusted file. If these values are manipulated to exceed the allocated buffer size, the system performs a write operation into adjacent memory regions.\nThe attack flow begins when a user is convinced to mount a specially crafted malicious disk image. Upon invocation of the mounting procedure, the macOS component responsible for interpreting the disk image format initializes its parser. The attacker provides a malformed disk image containing crafted header parameters that deceive the bounds checking routine. As the service proceeds to allocate or write to internal structures, the flawed bounds validation logic permits the write pointer to move outside the allocated buffer boundaries.\nBecause the write occurs in an unauthorized memory location, it causes immediate memory corruption. In the context of macOS system services, such corruption of sensitive internal state or control structures typically triggers an exception or a kernel panic, leading to unexpected system termination. This effectively results in a denial-of-service condition, as the affected system becomes unresponsive and must be restarted.\nThe impact of this vulnerability is primarily focused on system availability. By corrupting memory during the disk image mount operation, an attacker can reliably cause a system crash. While the current disclosure focuses on system termination, OOB write vulnerabilities are inherently critical as they may theoretically be weaponized for arbitrary code execution if the memory overwritten contains critical function pointers, return addresses, or data structures that influence subsequent execution flow.\nThe affected versions are macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The exploitation process is entirely local, requiring the malicious disk image to be present on the target filesystem or reachable via external storage media. No network exposure is required for the initial trigger, though the delivery of the malicious disk image may be facilitated via email, web download, or physical USB insertion."
}