Apple macOS EUVD-2026-104710

Exploitation requires the attacker to control the network file server that the target macOS host connects to - either by operating a malicious server, compromising a legitimate one, or achieving a man-in-the-middle position on the file-sharing session; the attacker then returns crafted responses that drive the integer underflow. Limiting factors: the attacker must already occupy this privileged network position (reflected as AC:H), the victim system must initiate or maintain a connection to that server, and the only outcome is denial of service (unexpected termination), not code execution or data access. Affected versions are macOS before Golden Gate 27, before Sequoia 15.8, and before Tahoe 26.7.

This is a medium-severity denial-of-service issue, not a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.9) confirms an availability-only impact (unexpected system termination) with no confidentiality or integrity loss, and explicitly flags high attack complexity (AC:H) because the attacker must first control the network file server the victim connects to. All real-world exploitation signals point low: EPSS is 0.17% (6th percentile), the vulnerability is NOT in CISA KEV, and no public POC is referenced. CISA's SSVC decision data reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - indicating neither active exploitation nor mass-scan automatability. The signals are mutually consistent (no conflict): a genuinely exploitable but low-probability, privileged-position DoS. One tagging discrepancy exists - the input Tags include 'Information Disclosure,' which contradicts the CVSS vector showing C:N/I:N and A:H; the actual impact is denial of service, not disclosure. Priority should be routine patch-cycle remediation, not emergency response.

An attacker who controls (or has compromised, or is impersonating via MITM) a network file server waits for a macOS client to connect and mount a share. The malicious server returns crafted responses that trigger an integer underflow (CWE-20) in the client's file-protocol handling, causing the macOS system to terminate unexpectedly. No public exploit is identified at time of analysis, and the high attack complexity plus the need for a privileged network position limit practical use to targeted scenarios.