CVE-2026-39873
A memory handling flaw in macOS can cause the system to crash when it connects to a malicious SMB server. The vulnerability is critical, with a CVSS score of 9.8, and has been fixed in recent macOS releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
macOS users running versions prior to Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. The flaw affects all Mac computers that use SMB networking.
Real-world impact
An attacker could trick a Mac into connecting to a malicious SMB server, causing the operating system to terminate unexpectedly, potentially leading to data loss or downtime.
Why this severity
The CVSS score is high because the flaw can be exploited over the network with no authentication, no user interaction, and it compromises confidentiality, integrity, and availability. The low attack complexity and lack of required privileges make it easy for attackers to cause a crash.
What to do about it
- 01Upgrade macOS to Sequoia 15.7.8 or later, Sonoma 14.8.8 or later, or Tahoe 26.6 or later.
- 02Restart the computer to complete the update.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128071release notesvendor advisory
- support.apple.com/en-us/128072release notesvendor advisory