Loading story…
Researchers disclosed the first public bypass of Apple Memory Integrity Enforcement (MIE) on macOS 26.4.1 by chaining two vulnerabilities: CVE-2026-64704 in SMBClient and CVE-2026-64699 in webdavfs. The SMB flaw is a type confusion issue triggered when a macOS client connects to a malicious SMB server, causing the kernel to reinterpret a Resolve ID context as a lease context and misuse attacker-influenced kernel pointers. The WebDAV flaw is a kernel memory disclosure bug triggered by a crafted HTTP 206 response from a malicious WebDAV server, leaking uninitialized kernel memory to userspace.
The researchers said the combined exploit chain produces arbitrary kernel read/write primitives and ultimately kernel code execution, allowing an unprivileged user to escalate privileges to root despite Apple’s layered kernel protections. Apple has patched both issues in macOS 26.6, and the disclosure was accompanied by a public exploit-development challenge and notice of a planned Black Hat USA presentation detailing the technique.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The disclosure announced a full presentation at Black Hat USA scheduled for August 5, 2026. The talk would cover the two vulnerabilities and the Apple MIE bypass technique.
The Calif post launched a public exploit-development challenge based on CVE-2026-64704 and CVE-2026-64699. The challenge centered on exploiting the two bugs used in the Apple MIE bypass chain.
On July 27, 2026, Calif Global published details of two macOS vulnerabilities chained to produce the first public bypass of Apple MIE on macOS 26.4.1. The disclosure explained that the SMBClient type confusion and WebDAV kernel memory disclosure together enabled kernel read/write primitives, kernel code execution, and escalation to root.
Apple addressed CVE-2026-64704 in SMBClient and CVE-2026-64699 in webdavfs in macOS 26.6. The two flaws could be chained to bypass Apple Memory Integrity Enforcement and achieve local privilege escalation to root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Calif disclosed a local privilege-escalation exploit against Apple systems using **M5** silicon that reportedly bypasses the chip’s **Memory Integrity Enforcement (MIE)** protections and grants a root shell on **macOS 26.4.1** from an unprivileged user context. The team said Anthropic’s **Mythos Preview** helped chain two previously unknown bugs and other techniques into a working exploit in five days, using only standard system calls. Apple was reportedly notified in advance and is working on a fix. The finding is significant because MIE was introduced to harden M5 and A19 devices against memory-corruption attacks such as buffer overflows and use-after-free flaws. Microsoft separately detailed **MDASH**, an internal AI-driven vulnerability discovery platform that coordinates more than 100 specialized agents and has already found **16 previously unknown vulnerabilities** in Windows networking and authentication components. Four of those flaws, including critical remote code execution bugs in `tcpip.sys` and the **IKEv2** service, were patched in the latest Patch Tuesday release. Microsoft said MDASH also identified issues in **IPsec** and **Netlogon**, including vulnerabilities reachable over the network without credentials, and described the system as a production-grade defensive capability now in internal use and limited private preview.
Jul 27, 2026
Apple patched two kernel memory disclosure vulnerabilities in the macOS `smbfs` driver, tracked as **CVE-2021-30844** and **CVE-2021-30845**, affecting macOS Big Sur 11.0 through 11.2.3. Both flaws could expose adjacent kernel heap data during SMB operations, creating conditions that could aid further exploitation. STAR Labs reported that Apple was notified in June and released fixes alongside security updates for affected systems. `CVE-2021-30844` stems from the `SMBIOC_T2RQ` `ioctl` path, where attacker-controlled data copied into `t2p->t_name` may not be NULL-terminated before later string handling, causing an out-of-bounds read and leaking kernel memory to an SMB server. `CVE-2021-30845` affects `smbfs_mount`, where insufficient validation of `unique_id_len` against the fixed-size `unique_id` buffer in `smb_mount_args` can also trigger an out-of-bounds read during a mount request. Proof-of-concept demonstrations used fake or controlled SMB servers to show unintended kernel data disclosure, and the recommended mitigation is to update macOS to the latest available version.
Jun 29, 2026
Researchers reported that Apple’s fix for `CVE-2021-30724` in the root-privileged `CVMServer` daemon introduced a new flaw, tracked as `CVE-2022-26721`, that could be reached from the Safari renderer sandbox on macOS. The bug stemmed from uninitialized cleanup metadata left behind when a bounds check aborted processing, creating a path for attacker-controlled `munmap` operations on arbitrary memory pages inside the service. Theori showed the issue could be turned into root code execution by shaping heap contents, using a binary-search-style oracle to infer `CVMServer` memory layout, and overwriting `dyld` private-memory function pointers. A proof of concept reportedly read `/var/db/SystemKey`, which can be used to decrypt macOS keychain files, underscoring the impact of the sandbox escape and privilege-escalation chain. Apple addressed the vulnerability in macOS 12.4 by replacing `malloc` with `calloc` to ensure the descriptor buffer was zero-initialized.
Jul 24, 2026