CVE-2026-43702 Overview
CVE-2026-43702 is a memory corruption vulnerability affecting multiple Apple operating systems. Processing a maliciously crafted video file may lead to unexpected application termination or corrupt process memory. Apple addressed the issue with improved memory handling across iOS, iPadOS, macOS, tvOS, and watchOS. The flaw is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a boundary-condition failure during media parsing. Local attack vector and required user interaction limit remote mass exploitation, but delivery through email attachments, messaging apps, or web-embedded media makes exploitation practical.
Critical Impact
A crafted video file can corrupt process memory or terminate applications, providing a foundation for potential arbitrary code execution within the affected process context.
Affected Products
- Apple iOS and iPadOS (fixed in 26.6 and 26.7)
- Apple macOS Sequoia 15.8, macOS Tahoe 26.6, and macOS Tahoe 26.7
- Apple tvOS 26.6 and watchOS 26.6
Discovery Timeline
- 2026-09-14 - CVE-2026-43702 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-43702
Vulnerability Analysis
The vulnerability resides in Apple's media-processing subsystem responsible for parsing video files. When the affected code path processes a malformed video container or codec structure, memory-handling routines fail to enforce proper bounds or lifetime checks. This produces memory corruption that can terminate the consuming application or leave process memory in an inconsistent state.
Exploitation requires a user to open or preview a crafted video file. Because Apple's media frameworks are shared across Mail, Messages, Safari, QuickLook, and third-party apps, a single crafted file can reach many application contexts. The local attack vector reflects that the file must be delivered to and processed on the target device.
Apple's advisory does not disclose the affected component name, the specific codec parser, or whether the corruption is heap-based, stack-based, or a use-after-free. The fix description references improved memory handling, consistent with tighter allocation, bounds validation, or object-lifetime tracking within the parser.
Root Cause
The root cause is improper restriction of memory buffer operations [CWE-119] during video file parsing. Malformed input drives the parser into a state where writes or reads exceed the intended buffer, or where freed memory is reused, corrupting process state.
Attack Vector
An attacker crafts a malicious video file and delivers it through email, messaging, a website, cloud storage, or removable media. When a user opens or previews the file with an application that uses the vulnerable media framework, the parser corrupts memory. Reliable code execution would require chaining with additional primitives, but denial of service through app termination is directly achievable.
No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE.
Detection Methods for CVE-2026-43702
Indicators of Compromise
- Repeated crashes of media-handling applications such as QuickLook, Preview, Safari, Messages, or Mail when opening video attachments
- Crash reports in ~/Library/Logs/DiagnosticReports/ referencing media frameworks (AVFoundation, CoreMedia, VideoToolbox)
- Video files with anomalous container headers, atypical codec parameters, or malformed metadata received from untrusted sources
Detection Strategies
- Monitor endpoint telemetry for abnormal termination signals (SIGSEGV, SIGBUS) in Apple media services and consumer applications
- Inspect email and web gateways for video attachments originating from low-reputation senders or domains
- Correlate crash events with recent file downloads or message attachments to identify targeted delivery attempts
Monitoring Recommendations
- Collect and centralize macOS unified logs and iOS crash telemetry to detect clustered media-parser failures
- Track software inventory to confirm devices are running patched OS builds
- Alert on execution of unsigned or unexpected child processes spawned by media-handling applications shortly after file open events
How to Mitigate CVE-2026-43702
Immediate Actions Required
- Update all Apple devices to iOS 26.6 or 26.7, iPadOS 26.6 or 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6 or 26.7, tvOS 26.6, or watchOS 26.6
- Prioritize devices that regularly receive external video content, including executive endpoints and shared workstations
- Instruct users to avoid opening video files from untrusted sources until patches are deployed
Patch Information
Apple released fixes across all affected platforms. See the vendor advisories: Apple Support Article #128066, Apple Support Article #128067, Apple Support Article #128068, Apple Support Article #128069, Apple Support Article #149041, Apple Support Article #149042, and Apple Support Article #149043.
Workarounds
- Block or quarantine video attachments at email and web gateways pending patch deployment
- Disable automatic media preview in Messages, Mail, and file browsers where operationally feasible
- Restrict opening of video files to sandboxed or non-privileged accounts
# Verify installed macOS build after patching
sw_vers -productVersion
sw_vers -buildVersion
# Confirm iOS/iPadOS build via MDM or on-device: Settings > General > About > Software Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
