CVE-2026-43677: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43677 Overview

CVE-2026-43677 is an out-of-bounds write vulnerability [CWE-787] in Apple macOS affecting the WebDAV client component. Connecting to a malicious WebDAV server can trigger memory corruption that leads to unexpected application termination. Apple addressed the flaw by removing the vulnerable code in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.

The vulnerability requires user interaction because the victim must connect to the attacker-controlled WebDAV server. Impact is limited to availability. Confidentiality and integrity are not affected according to the CVSS vector.

Critical Impact
A malicious WebDAV server can trigger an out-of-bounds write in the macOS WebDAV client, causing application termination and denial-of-service conditions on connected clients.

Affected Products

Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7
Apple macOS versions prior to Golden Gate 27

Discovery Timeline

2026-09-14 - CVE-2026-43677 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-43677

Vulnerability Analysis

The flaw is an out-of-bounds write in the macOS WebDAV client implementation. WebDAV (Web Distributed Authoring and Versioning) extends HTTP to allow remote file management, and macOS integrates a WebDAV client into Finder and the underlying webdavfs stack. When the client parses attacker-controlled server responses, it writes data past the bounds of an allocated buffer.

An out-of-bounds write corrupts adjacent memory. In this case, the corruption manifests as unexpected termination of the application handling the WebDAV connection. Apple's mitigation removed the vulnerable code path entirely rather than adding bounds validation.

Root Cause

The root cause is missing or insufficient length validation when the WebDAV client processes server-supplied response data. The client copies data into a fixed-size buffer without confirming that the source length fits within the destination allocation. This condition is classified under [CWE-787] Out-of-bounds Write.

Attack Vector

Exploitation requires the target to initiate a connection to a WebDAV server controlled by the attacker. The attacker can host a malicious server or coerce the victim through a davs:// link, mounted share, or a legitimate-looking file-sharing prompt. Once the client connects, the server returns crafted responses that trigger the out-of-bounds write during parsing.

The attack is network-reachable but constrained by the user interaction requirement. The confirmed impact is denial of service through application termination. No public proof-of-concept or in-the-wild exploitation has been reported.

No verified exploit code is publicly available for this vulnerability. Refer to the Apple Support Article 149035 for vendor-published details.

Detection Methods for CVE-2026-43677

Indicators of Compromise

Repeated crashes of Finder or processes linked against the WebDAV client library, with crash reports referencing memory corruption in webdavfs or related frameworks.
Outbound connections from macOS endpoints to unknown or newly registered WebDAV servers over HTTP or HTTPS on ports 80, 443, or non-standard ports.
macOS diagnostic reports in ~/Library/Logs/DiagnosticReports/ referencing EXC_BAD_ACCESS or heap corruption in WebDAV code paths.

Detection Strategies

Monitor endpoint telemetry for mount_webdav invocations targeting untrusted external hosts.
Correlate application crash events with recent WebDAV mount operations to identify potential exploitation attempts.
Inspect proxy and DNS logs for connections to WebDAV endpoints not previously observed in the environment.

Monitoring Recommendations

Enable macOS unified logging collection covering com.apple.webdavfs subsystems and forward to a centralized log platform.
Alert on unpatched macOS versions connecting to external WebDAV shares.
Track outbound WebDAV traffic patterns to establish a baseline and flag anomalies.

How to Mitigate CVE-2026-43677

Immediate Actions Required

Update affected macOS endpoints to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 as applicable.
Inventory managed Macs for versions below the fixed releases and prioritize patch deployment through MDM.
Advise users to avoid connecting to untrusted davs:// or http(s):// WebDAV shares until patching is complete.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The vendor addressed the issue by removing the vulnerable code. See Apple Support Article 149035, Apple Support Article 149042, and Apple Support Article 149043 for release-specific details.

Workarounds

Block outbound WebDAV traffic at the network perimeter to untrusted destinations until endpoints are patched.
Use MDM configuration profiles to restrict user-initiated mounts of external WebDAV shares.
Educate users to reject unsolicited prompts to open or mount remote WebDAV shares from untrusted sources.

bash

# Example: block WebDAV mount attempts to non-corporate hosts via pf firewall rule
# /etc/pf.anchors/webdav-block
block out proto tcp from any to ! <corporate_webdav_hosts> port { 80, 443 }