{"id":"CVE-2026-86871","kind":"vulnerability","aliases":["CVE-2026-86871"],"related":[],"title":"macOS: integer underflow lets a network file server crash the system","description":"An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.","summary":"An integer underflow in macOS input handling can be triggered by a network file server an attacker controls. The result is an unexpected system termination, a crash rather than code execution.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apple","infrastructure","macos","network-file-shares"],"not_affected_if":["no-network-file-servers","patched-macos"],"how_to_check":"- Check the macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` and compare it with the fixed releases.\n- unknown","fix":"- Update macOS to `27` (Golden Gate), `15.8` (Sequoia) or `26.7` (Tahoe), or later, as listed in the advisory.","status":"open","published_at":"2026-10-20T01:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:08:42+00:00","updated_at":"2026-10-25T04:08:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:08:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27` (Golden Gate), `15.8` (Sequoia) or `26.7` (Tahoe), or later, as listed in the advisory.","reach":"network","title":"macOS: integer underflow lets a network file server crash the system","impact":"low","summary":"An integer underflow in macOS input handling can be triggered by a network file server an attacker controls. The result is an unexpected system termination, a crash rather than code execution.","category":"infrastructure","nicknames":[],"who_cares":["macos","apple","network-file-shares"],"confidence":0.6,"needs_auth":"unknown","worst_case":"System crashes and terminates unexpectedly when a malicious server responds.","analyst_note":"","how_to_check":"- Check the macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` and compare it with the fixed releases.\n- unknown","needs_analyst":false,"not_affected_if":["no-network-file-servers","patched-macos"],"who_is_affected":"Macs that mount or connect to network file servers, where a server could be controlled by an attacker. Machines that never connect to untrusted file servers face less exposure. unknown for any further detail the sources do not give.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000558,"input_tokens":3284,"output_tokens":460,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86871':14A,17A '15.8':76C '26.7':79C '27':73C 'abl':91C 'address':60C 'appl':18B 'attack':41B,81C 'caus':93C 'code':54B 'control':42B,83C 'crash':9A,51B 'cve':12A,15A 'execut':55B 'file':7A,23B,38B,87C 'fix':68C 'gate':72C 'golden':71C 'handl':31B 'improv':62C 'infrastructur':19B 'input':30B,63C 'integ':2A,26B,57C 'issu':66C 'let':4A 'maco':1A,20B,29B,70C,74C,77C 'may':89C 'network':6A,22B,37B,86C 'network-file-shar':21B 'rather':52B 'result':44B 'sequoia':75C 'server':8A,39B,88C 'share':24B 'system':11A,48B,95C 'taho':78C 'termin':49B,96C 'trigger':34B 'underflow':3A,27B,58C 'unexpect':47B,94C 'valid':64C","nicknames":[],"mitigations":[],"who_affected":"Macs that mount or connect to network file servers, where a server could be controlled by an attacker. Machines that never connect to untrusted file servers face less exposure. unknown for any further detail the sources do not give.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86871","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86871","severity":null,"published_at":"2026-10-20T01:17:25+00:00","modified_at":"2026-10-20T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}