Apple’s M5 MIE bypass: what the researchers demonstrated

The interesting part of Calif’s M5 demonstration is that Memory Integrity Enforcement stayed enabled. The researchers still reached root through a local macOS chain. Understanding that result takes a closer look at the two bugs and at what memory tagging is designed to enforce.

Root access on a specific M5 configuration

Calif’s May 14 report describes a local, data-only kernel privilege escalation on macOS 26.4.1, build 25E253, running on M5 hardware. Its stated starting point was an unprivileged local user; the demonstrated outcome was root access while kernel MIE remained enabled. That is a controlled research result, not a claim of an observed widespread attack campaign or an unauthenticated internet takeover.

Calif’s original public report and tested configuration

Calif’s July 27 follow-up names CVE-2026-64704 in SMBClient and CVE-2026-64699 in WebDAV, and identifies macOS 26.6 as containing Apple’s fixes. The demonstration and the patch announcement happened on different dates, which is worth checking when older coverage still describes the bugs as unpatched.

Calif’s follow-up identifying the patched vulnerabilities

Where memory tagging fits into MIE

Memory tagging associates memory with tags and checks that accesses carry a compatible tag. Enhanced MTE extends that protection model. Apple’s MIE combines synchronous EMTE checks with type-aware allocators and protections for tag confidentiality. Synchronous reporting matters because a detected mismatch is handled at the offending access rather than being deferred.

The allocator and hardware have separate jobs. Allocation policy helps keep object types apart; retagging can distinguish a new allocation from a stale reference to the old storage. The hardware checks tags where the protection applies. Software still has to keep types, lengths, lifetimes and permission decisions correct.

Apple’s engineering explanation of Memory Integrity Enforcement

Passing a tag check does not prove that every use of the data is valid. Memory tagging also does not encrypt all kernel data. A system can enforce its tag rules while a separate defect discloses information or lets code interpret an object incorrectly. The details depend on what the integrated design covers.

The SMB and WebDAV findings

Apple classifies CVE-2026-64704 as type confusion in SMB, corrected through improved memory handling. Its standalone advisory describes a possible system-termination impact. CVE-2026-64699 is a WebDAV memory-initialization issue with potential kernel-memory disclosure. The Tahoe advisory lists both in the July 27 macOS 26.6 release.

Apple’s macOS Tahoe 26.6 security advisory

At a high level, the SMB flaw involved disagreement about the type of an object used in protocol processing. The WebDAV flaw exposed storage that had not been filled with the intended data. Combining them gave Calif a stronger demonstrated outcome than either short advisory entry describes on its own. Both the individual defect and its role alongside other failures matter when assessing impact.

A data-only attack targets security-relevant data rather than depending on newly injected executable code. That makes data integrity important alongside code-flow integrity. It does not make memory protections irrelevant whenever another kind of error exists.

Keep the result tied to the tested system

The report demonstrates one macOS build on M5 hardware. It does not establish an iPhone chain, a universal MTE failure or a working attack against every Mac. Apple describes the individual vulnerability impacts; Calif describes the result of combining the bugs. Both accounts need their attribution and scope intact.

For Mac owners, check that the applicable fixes are included in the installed supported release. MIE adds protection, but vulnerable OS components still need updates. Use the latest compatible release offered through Apple’s normal process rather than the old build used in the demonstration.

Apple’s macOS update instructions

For engineers, the report is a reason to examine data validity and confidentiality alongside access enforcement. Fixing one contributing bug can break a particular chain while MIE continues to constrain other failures. The demonstrated bypass and the value of the mitigation can both be assessed on their actual scope.

Source check: September 8, 2026. This article analyzes public work from Calif and Apple. Short Circuit LLC did not discover the vulnerabilities discussed here.