macOS AFP Client EUVD-2026-77899

Exploitation requires the victim to actively connect their macOS AFP client (afpfs) to an attacker-controlled 'malicious afpfs server' - this is the exact prerequisite named in the description and corresponds to the UI:R metric. The attacker cannot trigger it remotely without victim action; risk is limited to environments where users mount or connect to untrusted AFP/Apple Filing Protocol shares (e.g. via afp:// links, 'Connect to Server', or attacker-controlled network file servers). Systems running the patched builds (macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6) are not affected. No authentication of the victim is needed (PR:N), but the social/network requirement to induce the connection is the primary limiting factor.

This is a genuine but conditional client-side kernel vulnerability rather than a broadly wormable network flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) shows the network vector and lack of authentication, but the UI:R requirement is the decisive limiter: exploitation depends on the victim actively connecting their macOS AFP client to an attacker-controlled afpfs server - the attacker cannot reach out and trigger it unsolicited. Real-world risk signals are modest and consistent: EPSS is 0.20% (10th percentile), there is no CISA KEV listing (no confirmed active exploitation) and no public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H impact is Apple's standard scoring for a kernel memory-corruption primitive; the description only states corruption 'may lead' to compromise, so full confidentiality/integrity code-execution impact is asserted rather than demonstrated. Net: a legitimately-severe kernel bug worth patching promptly on any fleet where users connect to untrusted AFP shares, but not an emergency mass-exploitation scenario. No data conflicts - the CVSS network vector is consistent with the AFP-server attack model, and low EPSS with no KEV points to unweaponized, socially-gated risk.

An attacker stands up a malicious AFP (Apple Filing Protocol) file server and lures a macOS user into connecting to it - for example via a crafted afp:// link, a spoofed network share, or a malicious 'Connect to Server' prompt. When the victim's afpfs kernel client parses the malicious server responses, a buffer overflow triggers an out-of-bounds write corrupting kernel memory, potentially escalating to kernel-level code execution or a system crash. No public proof-of-concept or exploit code is currently identified, and the user must actively initiate the connection (UI:R).