CVE-2026-43666: Apple iPadOS DoS Vulnerability

CVE-2026-43666 Overview

CVE-2026-43666 is an out-of-bounds write vulnerability [CWE-787] affecting multiple Apple operating systems. An attacker positioned on the local network can trigger the flaw to cause a denial-of-service condition on affected devices. Apple addressed the issue with improved bounds checking and released fixes across its operating system portfolio. The vulnerability does not impact confidentiality or integrity, but it produces a high availability impact on vulnerable endpoints.

Critical Impact
A local network attacker can cause a denial-of-service on iOS, iPadOS, macOS, tvOS, visionOS, and watchOS devices by triggering an out-of-bounds write.

Affected Products

Apple iOS and iPadOS prior to 18.7.9 and prior to 26.5
Apple macOS Sequoia prior to 15.7.7, macOS Sonoma prior to 14.8.7, macOS Tahoe prior to 26.5
Apple tvOS, visionOS, and watchOS prior to 26.5

Discovery Timeline

2026-05-11 - CVE-2026-43666 published to the National Vulnerability Database (NVD)
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43666

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in an Apple operating system component that processes data received over the local network. When the affected component handles a crafted input, it writes beyond the bounds of an allocated buffer. This memory corruption causes the process — or in some cases the underlying subsystem — to terminate, resulting in a denial-of-service. Apple's advisory states the issue was resolved with improved bounds checking, indicating the root cause is missing or insufficient validation of a length or index value before a write operation.

Root Cause

The affected code path does not adequately validate the size or offset of attacker-controlled data before performing a write into a fixed-size buffer. Apple's fix introduces stricter bounds checking on the input parameters used to compute the destination write position. Without that check, malformed network traffic reaches the write primitive and corrupts adjacent memory.

Attack Vector

Exploitation requires adjacency on the local network. The attacker sends specially crafted traffic to a vulnerable device, reaching the affected service without prior authentication or user interaction. The flaw does not yield code execution or data disclosure based on Apple's description and the CVSS metrics. The realized impact is process or service crash, disrupting availability of the targeted functionality. Apple has not reported in-the-wild exploitation, and CISA has not added CVE-2026-43666 to the Known Exploited Vulnerabilities catalog.

No verified public proof-of-concept code is available. Refer to the Apple Support Documents for vendor-supplied technical context.

Detection Methods for CVE-2026-43666

Indicators of Compromise

Unexpected crashes or reboots on Apple devices coinciding with anomalous local network traffic
Crash reports in /Library/Logs/DiagnosticReports/ referencing the affected networking component on macOS hosts
Repeated service restarts on iOS, iPadOS, tvOS, visionOS, or watchOS devices on the same local segment

Detection Strategies

Monitor endpoint telemetry for repeated kernel or daemon crashes on Apple devices following local network activity
Inspect local network captures for malformed packets targeting Apple-specific services on managed segments
Correlate device crash events across multiple Apple endpoints on the same VLAN to identify lateral DoS attempts

Monitoring Recommendations

Centralize macOS and iOS crash reports and alert on bursts of crashes referencing the same binary
Track OS version inventory to identify devices running builds earlier than iOS/iPadOS 18.7.9, 26.5, macOS 14.8.7, 15.7.7, or 26.5
Baseline local broadcast and multicast traffic volumes and alert on anomalies originating from non-trusted hosts

How to Mitigate CVE-2026-43666

Immediate Actions Required

Update affected Apple devices to iOS 18.7.9 / iPadOS 18.7.9 or iOS 26.5 / iPadOS 26.5
Update macOS endpoints to Sequoia 15.7.7, Sonoma 14.8.7, or Tahoe 26.5
Update tvOS, visionOS, and watchOS devices to version 26.5
Restrict access to corporate VLANs that host managed Apple devices to known, authenticated hosts

Patch Information

Apple has released patches across its product portfolio. See the following advisories for build-specific details: Apple Support Document 127110, 127111, 127115, 127116, 127117, 127118, 127119, and 127120.

Workarounds

Segment Apple devices onto trusted network zones and block untrusted local peers from reaching them
Disable unused local network discovery and sharing services on macOS until patches are applied
Enforce mobile device management (MDM) policies that require minimum OS versions for network access

bash

# Verify macOS build version against the fixed releases
sw_vers -productVersion

# Check iOS/iPadOS version via MDM query or on-device
# Settings > General > About > Software Version