CVE-2026-43697: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43697 Overview

CVE-2026-43697 is an out-of-bounds read vulnerability affecting Apple macOS 3D file processing. Processing a maliciously crafted 3D file can trigger the flaw, leading to memory disclosure or process termination. Apple addressed the issue with improved bounds checking in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The weakness maps to [CWE-125] Out-of-Bounds Read.

Critical Impact
An attacker can convince a user to open a crafted 3D file, causing an out-of-bounds read that may disclose process memory or crash the affected application.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS versions prior to Sequoia 15.8
Apple macOS versions prior to Tahoe 26.7

Discovery Timeline

2026-09-14 - CVE-2026-43697 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-43697

Vulnerability Analysis

The vulnerability resides in the macOS component responsible for parsing 3D file formats. When the parser processes a crafted 3D file, it reads memory outside the bounds of an allocated buffer. The read can return uninitialized or adjacent heap contents to the calling code path. Exploitation requires local access and user interaction, typically opening or previewing the malicious file.

Successful triggering results in high confidentiality impact through memory disclosure and high availability impact through application crashes. Integrity is not directly affected because the flaw is a read rather than a write primitive. Attackers may combine memory disclosure with other bugs to defeat address space layout randomization (ASLR) in a broader exploit chain.

Root Cause

The parser fails to validate offset or length fields embedded in the 3D file before dereferencing pointers into a fixed-size buffer. Apple's advisory states the fix introduces improved bounds checking on the affected code path. The [CWE-125] classification confirms the underlying weakness is missing validation of an index or size prior to a read operation.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted 3D asset through email, a website, a messaging platform, or removable media. When a user opens the file with a vulnerable macOS component or an application that relies on the affected framework, the parser triggers the out-of-bounds read. No elevated privileges are required to reach the vulnerable code path.

Apple has not disclosed the specific 3D format or internal function affected. Refer to the Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for the authoritative fix descriptions.

Detection Methods for CVE-2026-43697

Indicators of Compromise

Unexpected crashes or EXC_BAD_ACCESS reports in macOS crash logs generated by processes that handle 3D content such as Preview, Quick Look, or third-party viewers.
Delivery of unsolicited 3D files (for example .usdz, .usd, .obj, .dae) via email, chat, or web downloads to end users.
Repeated user-opened file events tied to 3D asset extensions followed by process termination in endpoint telemetry.

Detection Strategies

Monitor macOS DiagnosticReports for crashes in Quick Look, Preview, and applications that invoke Apple's 3D parsing frameworks.
Alert on inbound files with 3D asset extensions from untrusted senders, particularly through mail gateways and web proxies.
Correlate crash telemetry with recent file downloads to identify potential exploitation attempts.

Monitoring Recommendations

Track macOS build versions across the fleet to identify hosts still running versions earlier than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.
Ingest crash reports and file-open events into a centralized log platform for retrospective hunting.
Baseline normal 3D file usage per user role so anomalous processing stands out.

How to Mitigate CVE-2026-43697

Immediate Actions Required

Update macOS endpoints to Golden Gate 27, Sequoia 15.8, or Tahoe 26.7 as soon as the update is available for each device class.
Instruct users not to open 3D files received from untrusted or unexpected sources until patching is complete.
Prioritize patching on developer, creative, and engineering workstations that routinely handle 3D content.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Full patch details are documented in Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043.

Workarounds

Block or quarantine common 3D asset extensions at mail and web gateways until endpoints are patched.
Disable Quick Look previews of untrusted attachments through mobile device management (MDM) policy where feasible.
Enforce least-privilege application usage so 3D content is processed only in approved viewers on patched systems.

bash

# Verify macOS build version on an endpoint
sw_vers -productVersion
softwareupdate --list
sudo softwareupdate --install --all --restart