Loading vulnerability…
Out-of-bounds write in macOS SMB client decompression
CVE-2026-28825 is an out-of-bounds write vulnerability in Apple’s SMB client kernel component, smbfs.kext, affecting the SMB 3.1.1 compression handling path. The vulnerable code is in the function smb2_rq_decompress_read, specifically the chained compression transform parsing logic. The routine allocates a scratch buffer sized to twice OriginalCompressedSegmentSize, using one half for compressed input and the other half for decompressed output. Although the code validates that the attacker-controlled OriginalPayloadSize fits within the output portion of the buffer, it fails to verify that the compressed chunk length also fits within the input portion before copying data. In the vulnerable path, compress_len is derived from the SMB transform Length field minus 4, and attacker-controlled data is copied into the heap buffer by md_get_mem without adequate bounds checking. A malicious SMB server can therefore send a crafted compressed READ response that causes a kernel heap overflow. Apple addressed the issue by adding improved bounds checking to ensure the compressed input length does not exceed OriginalCompressedSegmentSize before the copy occurs. Apple describes the impact as allowing an app to modify protected parts of the file system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can corrupt kernel heap memory in the SMB client, leading at minimum to kernel panic and system instability. Because the flaw is an out-of-bounds write in kernel context, it may also enable an attacker to alter privileged kernel state and potentially achieve modification of protected parts of the file system. The documented impact from Apple is unauthorized modification of protected file-system areas. Depending on exploit reliability, the bug could plausibly be leveraged for local privilege escalation or broader kernel compromise via a malicious SMB server delivering crafted responses to a vulnerable client.
If you can’t patch tonight, do this now.
Until patches are applied, reduce exposure by avoiding connections to untrusted SMB servers and restricting the ability of systems to mount attacker-controlled SMB shares. Limit SMB usage to trusted servers, disable or tightly control access to SMB resources where operationally feasible, and monitor for crashes or anomalous behavior associated with SMB share mounting or file access. Network and policy controls that prevent users or applications from interacting with untrusted SMB endpoints can reduce exploitability, but vendor patches are the primary mitigation.
Patch, then assume compromise.
Upgrade to a fixed macOS release that includes Apple’s bounds-checking correction for the SMB client. Reported fixed versions are macOS Tahoe 26.4, macOS Sequoia 15.7.5, and macOS Sonoma 14.8.5. The fix adds validation in the decompression path to reject cases where the compressed chunk length exceeds OriginalCompressedSegmentSize.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.