medium · CVSS v3 5.9 · EPSS 0.00169

CVE-2026-86871

An integer underflow in macOS file server handling could lead to unexpected system termination. The flaw was mitigated by improved input val

Overview

An integer underflow in macOS file server handling could lead to unexpected system termination. The flaw was mitigated by improved input validation in recent macOS releases. It affects systems that rely on network file servers.

Description

An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.

Impact

The vulnerability can cause denial of service by terminating the system, impacting availability for users and administrators. Confidentiality and integrity are not directly affected, but the disruption can hinder operations.

Remediation

Apply the latest macOS updates that include the integer underflow fix (Golden Gate 27, Sequoia 15.8, Tahoe 26.7). Ensure network file servers are properly validated and restrict access to trusted hosts. Monitor system logs for unexpected termination events.

Risk context

Severity is medium with a CVSS v3 score of 5.9 and an EPSS of 0.00169, indicating low likelihood of exploitation but still worth addressing promptly to prevent potential denial of service.

Affected products

  • Apple macOS Golden Gate
  • Apple macOS Sequoia
  • Apple macOS Tahoe

Scores

Severity
medium
CVSS v2
5.4
CVSS v3
5.9
CVSS v4
—
EPSS
0.00169

integer underflow macOS file server denial of service patch availability EPSS

← All CVEs

Related CVEs

medium

CVE-2026-96902

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.

View analysis

medium

CVE-2026-8355

IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters.

View analysis

medium

CVE-2026-109441

LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared default bridge network with inter-container communication enabled. Authenticated users with code execution in their own sandbox can connect directly to other tenants' containers, bypassing require_workspace_owner checks to read files such as vault secrets from exposed servers.

View analysis

medium

CVE-2026-28850

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data.

View analysis