CVE-2026-43656: Apple iPadOS Buffer Overflow Vulnerability

CVE-2026-43656 Overview

CVE-2026-43656 is an out-of-bounds write vulnerability [CWE-787] affecting Apple iOS, iPadOS, and macOS. Parsing a maliciously crafted file can trigger memory corruption and cause unexpected application termination. Apple addressed the issue through improved input validation in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. The flaw is network-reachable through file delivery channels such as email, messaging, and web downloads, requires no privileges, and needs no user interaction beyond opening the crafted file in a vulnerable parser.

Critical Impact

A maliciously crafted file can write beyond an allocated buffer in a system parser, terminating the affected application and corrupting adjacent memory on unpatched Apple devices.

Affected Products

• Apple iOS and iPadOS prior to 18.7.9 and prior to 26.5
• Apple macOS Sonoma prior to 14.8.7 and macOS Sequoia prior to 15.7.7
• Apple macOS Tahoe prior to 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-43656 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43656

Vulnerability Analysis

The defect is an out-of-bounds write [CWE-787] in an Apple file-parsing component shared across iOS, iPadOS, and macOS. When the parser processes a malformed file, length or offset fields used during deserialization are not validated against the destination buffer size. The parser then writes attacker-influenced bytes past the end of the allocation. The immediate consequence documented by Apple is unexpected application termination, which indicates a process-level denial of service. Out-of-bounds writes of this class also have potential to corrupt heap metadata or adjacent objects, depending on allocator state and the controllability of the overwrite.

Root Cause

The root cause is missing or insufficient input validation in the parser before performing a memory copy. Apple's fix description states the issue was "addressed with improved input validation," which is consistent with adding explicit bounds checks on field sizes prior to writing into the target buffer.

Attack Vector

The attack vector is network-adjacent file delivery. An attacker hosts or transmits a crafted file and induces the victim to open it with a vulnerable system component. Because the CVSS vector indicates no privileges and no user interaction beyond standard file handling, automatic preview or indexing pathways that invoke the affected parser increase exposure.

No verified proof-of-concept code is published for CVE-2026-43656. Refer to the Apple Support Article #127110 and the related advisories for component-level details.

Detection Methods for CVE-2026-43656

Indicators of Compromise

• Repeated, unexpected crashes of the same Apple system process or application immediately after opening a file from email, messaging, or web download.
• Crash reports referencing the affected parser with signatures such as EXC_BAD_ACCESS or heap corruption traces in ~/Library/Logs/DiagnosticReports/ on macOS.
• Inbound delivery of unusual file types to endpoints running Apple OS builds older than the fixed versions.

Detection Strategies

• Inventory Apple endpoints and compare OS build numbers against the fixed releases (iOS/iPadOS 18.7.9, 26.5; macOS 14.8.7, 15.7.7, 26.5).
• Correlate mail and web gateway file delivery logs with subsequent process crashes on the receiving endpoint within a short time window.
• Hunt for anomalous parsing of unsolicited attachments by system services that should not normally execute on user-supplied content.

Monitoring Recommendations

• Forward macOS ReportCrash artifacts and iOS MDM crash telemetry into a centralized analytics platform for trend analysis.
• Alert on duplicate crash signatures from the same binary across multiple users, which often indicates a malicious file campaign.
• Track outbound URL patterns and attachment hashes associated with delivery to crashed endpoints for retroactive blocking.

How to Mitigate CVE-2026-43656

Immediate Actions Required

• Update all Apple endpoints to iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Sonoma 14.8.7, macOS Sequoia 15.7.7, or macOS Tahoe 26.5.
• Enforce update compliance through MDM and block non-compliant devices from sensitive resources until patched.
• Warn users to avoid opening unsolicited files until devices report the fixed build.

Patch Information

Apple released fixes in the OS versions listed above. Refer to the official advisories: Apple Support Article #127110, Apple Support Article #127111, Apple Support Article #127115, Apple Support Article #127116, and Apple Support Article #127117.

Workarounds

• Restrict delivery of uncommon file types at the mail and web gateway pending patch deployment.
• Disable automatic preview, indexing, or thumbnail generation for untrusted file sources where configurable.
• Apply Lockdown Mode on high-risk iOS and macOS user accounts to reduce the parsing attack surface.

# Verify macOS build meets the fixed version
sw_vers -productVersion
# Expected: 14.8.7, 15.7.7, or 26.5 (or later)

# Query enrolled iOS/iPadOS versions via MDM (example: jamf)
# Look for devices reporting builds older than 18.7.9 or 26.5