External risk intelligence

Apple iOS Kernel Memory Corruption via Malicious NFS Server

CVE advisorySeverity: HIGH (CVSS 8.8)

CVE-2026-28931

The vulnerability requires a user to connect to a malicious NFS server. While network-based, NFS is typically used in trusted internal network environments or via controlled VPN tunnels rather than being exposed directly to the public internet in standard consumer or enterprise deployments.

Buffer Overflow

Apple Ipados

before 26.626.0 to before 26.6

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Apple operating systems that could allow an attacker to corrupt kernel memory by connecting to a malicious Network File System (NFS) server. While the risk is assessed as unlikely due to the typical use of NFS in controlled environments, the potential for severe impact warrants attention to confirm if any systems are exposed.

Malicious servers could corrupt system memory.
NFS use in trusted networks lowers risk.
Confirm relevance and exposure of affected systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by setting up a malicious Network File System (NFS) server. Users who connect to this server could trigger a buffer overflow in the device's operating system, potentially leading to memory corruption that allows for significant compromise.

Entry condition: User connects to malicious NFS server.
Trigger point: Connecting to the server initiates the overflow.
Resulting risk: Kernel memory corruption and full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A buffer overflow vulnerability, when exploited by connecting to a malicious NFS server, could lead to kernel memory corruption. This could impact the stability and integrity of the affected operating system.

Kernel memory could be corrupted.
Via connection to a malicious NFS server.
System instability or crashes may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and device owners are responsible for addressing this critical kernel memory corruption vulnerability. The first practical step is to identify all affected Apple devices, confirm their network exposure and business criticality, and then coordinate remediation efforts with the appropriate asset owners.

Device owners and security teams must own this.
Verify affected devices and exposure first.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the software affected by CVE-2026-28931?

This vulnerability affects the kernel in Apple's major operating systems, including iOS, iPadOS, macOS Tahoe, tvOS, and watchOS. These systems use the kernel as the core foundation to manage hardware resources and run applications. The issue specifically resides in how the system handles Network File System (NFS) connections, which are protocols used to access files over a network as if they were stored on a local drive.

What does this vulnerability mean for system security?

This is a buffer overflow vulnerability, categorized as CWE-120. In plain terms, the system fails to properly check the size of incoming data from an NFS server, allowing it to write past the allocated memory buffer. This memory corruption can impact the kernel, which is the most privileged part of the operating system, potentially leading to system crashes or loss of control over the device's integrity.

How is this vulnerability triggered?

The trigger requires a user to connect their device to a malicious NFS server. Once the connection is established and data is exchanged, the flawed bounds checking allows the overflow to occur. Simply having the NFS capability enabled on a device is not enough to trigger the bug; the device must actively interact with a specifically crafted, malicious server designed to send oversized data.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies the risk as unlikely for most users. Because NFS is typically used in trusted internal networks or via controlled VPN tunnels, it is rarely exposed directly to the public internet. If your device only connects to known, secure networks, the likelihood of encountering the specific malicious server required to trigger this vulnerability is significantly lower.

What should I do to address CVE-2026-28931?

The first step is to inventory your Apple devices to identify those running versions prior to 26.6. Since this is a kernel-level issue, remediation involves applying the official software updates provided by Apple. Once you have identified which systems are running the affected versions, prioritize updating them to version 26.6 or later to ensure the improved bounds checking is in place.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.