OPEN X SECURITY A server said zero, and the macOS kernel believed it: CVE-2026-28931
← RESEARCH
FEATURED AUG 3, 2026

A server said zero, and the macOS kernel believed it: CVE-2026-28931

A single unsigned subtraction turns the macOS NFS client's bounds check into one that can never fail. The full writeup on CVE-2026-28931 is on the way.

SECURITY RESEARCHAPPLE
macOS Tahoe 26.6 Software Update, the release carrying the CVE-2026-28931 fix
COMING SOON
Publishing soon!

The full writeup is on its way. Subscribe below to get it the moment it goes live.