macOS CVE-2026-28835

Without a disclosed CVSS vector, EPSS score, or KEV status, quantitative risk assessment is constrained; however, several qualitative factors suggest moderate real-world risk. The attack vector is network-based (requiring an attacker to control or intercept an SMB share), likely with medium complexity for crafting a malicious share. The technical impact is denial of service via system termination rather than data exfiltration or privilege escalation, which limits severity compared to remote code execution vulnerabilities. The fact that Apple released patches for three macOS versions indicates the vulnerability was deemed worthy of rapid patching, suggesting internal risk models flagged it as material. The requirement that a user actively mount the malicious share introduces a social engineering or physical access component that reduces automated exploitation likelihood. Overall, this is a denial-of-service vulnerability with moderate real-world risk, particularly for organizations using SMB shares in environments where share sources cannot be fully controlled or validated.

An attacker sets up a malicious SMB file server or performs a man-in-the-middle attack on SMB traffic and crafts a specially formatted SMB share response that contains a use-after-free trigger in the share metadata or protocol negotiation sequence. When a victim user attempts to mount this share (either through manual connection or via a network browsing action), the macOS SMB client processes the malicious data, triggering the use-after-free condition, which causes the kernel to crash and the system to terminate. This could be used in a targeted denial-of-service attack against organizations that rely on SMB shares, or as a component of a larger attack chain if the vulnerability can be escalated to code execution.