CVE-2026-65400 macOS Screen Sharing pre-auth bypass - oversized RFB SRP (type 36) auth frame length field correlated with subsequent authenticated session

Duo Tech@duotech

•updated Aug 17, 2026•0•0•18

Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.