---
id: "CVE-2026-86871"
kind: "vulnerability"
aliases: ["CVE-2026-86871"]
title: "macOS: integer underflow lets a network file server crash the system"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple", "infrastructure", "macos", "network-file-shares"]
not_affected_if: ["no-network-file-servers", "patched-macos"]
published_at: "2026-10-20T01:17:25+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T04:08:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86871", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# macOS: integer underflow lets a network file server crash the system

An integer underflow in macOS input handling can be triggered by a network file server an attacker controls. The result is an unexpected system termination, a crash rather than code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the macOS version under Apple menu > About This Mac, or run `sw_vers -productVersion` and compare it with the fixed releases.
- unknown

## Fix

- Update macOS to `27` (Golden Gate), `15.8` (Sequoia) or `26.7` (Tahoe), or later, as listed in the advisory.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86871

## From the sources

An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_