Preface: Apple has released macOS Tahoe 26.6.1 to fix a critical Screen Sharing security vulnerability. Apple pushed out this emergency, un-betaed update alongside patches for older operating systems, including macOS Sequoia 15.7.9 and macOS Sonoma 14.8.9.

Background: The root cause of CVE-2026-65400 is an error-handling and state-management flaw in how the screensharingd binary handles structural network data frames before the SRP math even starts.

How the Exploit Skips the Code Structure

When an attacker initiates a Screen Sharing connection, the user-space daemon expects a network frame stating the length of the incoming SRP payload.

i.               The Stale Register Bug: The daemon reads a 4-byte frame length. If the read is successful, the CPU data register used for checking errors is set to 0 (indicating no_error).

ii.              The Size Validation Failure: The daemon checks if the requested frame length is abnormally large (specifically ≥ 32768 bytes). If the attacker sends a massive, oversized frame, a validation check fails.

iii.            The Logical Short-Circuit: Instead of branching to a clean shutdown or an explicit return false, the daemon branches to an error-handling block that accidentally returns the stale 0 data register as its status.

Vulnerability details: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

Official announcement: Please refer to the link for details – https://support.apple.com/en-us/148171