Loading story…
Apple patched two kernel memory disclosure vulnerabilities in the macOS smbfs driver, tracked as CVE-2021-30844 and CVE-2021-30845, affecting macOS Big Sur 11.0 through 11.2.3. Both flaws could expose adjacent kernel heap data during SMB operations, creating conditions that could aid further exploitation. STAR Labs reported that Apple was notified in June and released fixes alongside security updates for affected systems.
CVE-2021-30844 stems from the SMBIOC_T2RQ ioctl path, where attacker-controlled data copied into t2p->t_name may not be NULL-terminated before later string handling, causing an out-of-bounds read and leaking kernel memory to an SMB server. CVE-2021-30845 affects smbfs_mount, where insufficient validation of unique_id_len against the fixed-size unique_id buffer in smb_mount_args can also trigger an out-of-bounds read during a mount request. Proof-of-concept demonstrations used fake or controlled SMB servers to show unintended kernel data disclosure, and the recommended mitigation is to update macOS to the latest available version.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
STAR Labs publicly released advisories for CVE-2021-30844 and CVE-2021-30845, including technical root-cause analysis and proof-of-concept demonstrations showing kernel memory disclosure to SMB infrastructure. The write-ups documented affected versions, exploitation conditions, and patch timing.
Apple released fixes for the two smbfs vulnerabilities, addressing an out-of-bounds read in SMBIOC_T2RQ handling and another in smbfs_mount unique_id_len processing. Users were advised to update macOS to the latest available version.
STAR Labs disclosed CVE-2021-30844 and CVE-2021-30845 to Apple. Both vulnerabilities affected macOS Big Sur 11.0 through 11.2.3 and could leak kernel memory via out-of-bounds reads in the smbfs kernel extension.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed the first public bypass of Apple **Memory Integrity Enforcement (MIE)** on macOS 26.4.1 by chaining two vulnerabilities: `CVE-2026-64704` in **SMBClient** and `CVE-2026-64699` in **webdavfs**. The SMB flaw is a type confusion issue triggered when a macOS client connects to a malicious SMB server, causing the kernel to reinterpret a Resolve ID context as a lease context and misuse attacker-influenced kernel pointers. The WebDAV flaw is a kernel memory disclosure bug triggered by a crafted HTTP `206` response from a malicious WebDAV server, leaking uninitialized kernel memory to userspace. The researchers said the combined exploit chain produces arbitrary kernel read/write primitives and ultimately kernel code execution, allowing an unprivileged user to escalate privileges to **root** despite Apple’s layered kernel protections. Apple has patched both issues in macOS 26.6, and the disclosure was accompanied by a public exploit-development challenge and notice of a planned Black Hat USA presentation detailing the technique.
Jul 30, 2026
Apple released security updates for **macOS Tahoe 26.6.1**, **Sequoia 15.7.9**, and **Sonoma 14.8.9** to fix a Screen Sharing vulnerability that could let an attacker on the same network authenticate without valid credentials. The issue appears to primarily affect Macs where Screen Sharing has been explicitly enabled, and Apple said there is no evidence it has been exploited in the wild. Apple also noted that Tahoe 26.6.1 includes broader security fixes available through the standard Software Update mechanism. The updates follow disclosure of **`CVE-2026-39875`**, a CUPS flaw in macOS that allows an unprivileged local user to chain logic bugs in the privileged `cupsd` daemon and gain an arbitrary file-write capability as root. A public proof-of-concept showed how an attacker could register a malicious printer, capture and replay a valid CUPS authentication token, and abuse a `file://` device URI to write to attacker-chosen local paths outside SIP protection. Apple patched affected versions of Sonoma, Sequoia, and Tahoe, and defenders were urged to install updates quickly and watch for suspicious printer registrations, device URI changes, and print jobs targeting file-based destinations.
Aug 8, 2026
Apple released security updates for **macOS Sequoia 15.7.5** and **macOS Sonoma 14.8.5**, patching a wide range of vulnerabilities across core operating system components, networking, printing, privacy controls, the kernel, and bundled open-source software. The advisories describe flaws that could lead to **privilege escalation**, **sandbox escape**, **unauthorized access to sensitive data**, **kernel memory disclosure**, **denial of service**, **arbitrary file write**, and modification of protected file system areas. Affected components include high-risk areas such as **Kernel**, **CoreServices**, **CUPS**, **CFNetwork**, **NetAuth**, **SMB**, **TCC**, **Security**, and **PackageKit**, with additional privacy-related fixes for apps and services including **Mail**, **Messages**, **Focus**, **Phone**, and **Spotlight**. Apple also shipped patches for third-party code in **Apache**, **curl**, and ImageIO-related libraries, and credited external researchers and organizations including **KU Leuven**, **Google**, **Trend Micro Zero Day Initiative**, **Nosebeard Labs**, **DBAppSecurity WeBin lab**, and Renault researchers for reporting the issues.
Jun 29, 2026