CVE-2026-43747: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43747 Overview

CVE-2026-43747 is an out-of-bounds read vulnerability [CWE-125] in Apple macOS file parsing logic. Parsing a maliciously crafted file can trigger memory access beyond allocated buffer boundaries, resulting in unexpected application termination. Apple addressed the issue with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.

The vulnerability requires local access and user interaction. An attacker must convince a target to open a crafted file for exploitation to occur. Successful exploitation produces high confidentiality and availability impact but does not affect integrity.

Critical Impact
Processing a maliciously crafted file can cause application crashes and potential memory disclosure on unpatched macOS systems.

Affected Products

Apple macOS Sequoia versions prior to 15.7.8
Apple macOS Sonoma versions prior to 14.8.8
Apple macOS Tahoe versions prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43747 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43747

Vulnerability Analysis

The flaw is an out-of-bounds read [CWE-125] in a macOS file parser. When the affected component processes a file with attacker-controlled structural fields, it reads memory outside the intended buffer. This condition typically stems from missing or incorrect length validation prior to indexed memory access.

The immediate observable impact is unexpected application termination. Out-of-bounds reads can also leak adjacent process memory into error paths, logs, or subsequent output, which explains the high confidentiality impact recorded for this issue. Apple resolved the condition by introducing improved bounds checking in the parsing routine.

Root Cause

The root cause is insufficient validation of size or offset fields inside the parsed file format. The parser trusts attacker-supplied values and computes a read location that extends past the allocated object. Without a boundary check, the read proceeds and either returns unintended data or triggers a memory access fault.

Attack Vector

Exploitation requires local delivery of a crafted file and user interaction to open it. Common delivery paths include email attachments, downloads from web pages, USB media, and shared network volumes. No privileges are required prior to exploitation. Apple has not reported active exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Apple has not published low-level technical details for CVE-2026-43747. See the Apple Support Document #128067, Apple Support Document #128071, and Apple Support Document #128072 for the affected component references.

Detection Methods for CVE-2026-43747

Indicators of Compromise

Repeated unexpected termination of a macOS application shortly after opening a file from an untrusted source.
Crash reports in ~/Library/Logs/DiagnosticReports/ referencing EXC_BAD_ACCESS or KERN_INVALID_ADDRESS during file parsing.
Delivery of unusual file types via email, messaging, or download that trigger immediate application exit.

Detection Strategies

Collect and inspect macOS .ips crash reports for patterns that match the affected parser stack frames.
Alert on execution of macOS versions below 15.7.8, 14.8.8, or 26.6 in endpoint inventory data.
Correlate file downloads from untrusted origins with immediate application crash telemetry on the same host.

Monitoring Recommendations

Track macOS build and version telemetry across all managed endpoints to identify unpatched hosts.
Forward diagnostic crash reports to a central log store for retrospective analysis and hunting.
Monitor gateway and mail security logs for delivery of file types associated with the affected parser.

How to Mitigate CVE-2026-43747

Immediate Actions Required

Update affected endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Prioritize patching for users who routinely open files received from external senders.
Verify installed OS build via sw_vers after deployment to confirm remediation.

Patch Information

Apple has released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Refer to Apple Support Document #128067, Apple Support Document #128071, and Apple Support Document #128072 for release notes and component-level details.

Workarounds

Avoid opening files from untrusted or unverified sources until patches are applied.
Restrict delivery of unusual file types at email and web gateways for unpatched endpoints.
Enforce standard user accounts and application sandboxing to limit the blast radius of parser crashes.

bash

# Verify installed macOS version after patching
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart