CVE-2026-43757: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43757 Overview

CVE-2026-43757 is an out-of-bounds read vulnerability [CWE-125] affecting multiple versions of Apple macOS. Apple addressed the issue with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. A malicious application can trigger the flaw to cause unexpected system termination. The vulnerability carries a CVSS 3.1 score of 9.8 based on the NVD-published vector, and it is tagged critical in vendor advisories.

Critical Impact
A malicious app can read out-of-bounds memory in macOS, causing unexpected system termination and potential exposure of sensitive kernel or process memory contents.

Affected Products

Apple macOS Sequoia (prior to 15.7.8)
Apple macOS Sonoma (prior to 14.8.8)
Apple macOS Tahoe (prior to 26.6)

Discovery Timeline

2026-07-27 - CVE-2026-43757 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43757

Vulnerability Analysis

The vulnerability is an out-of-bounds read condition in a macOS component. Apple's advisory states the issue was resolved with improved bounds checking, indicating that a code path failed to validate an index or length before dereferencing a memory buffer. An attacker-controlled app can supply inputs that cause the vulnerable routine to read past the end of an allocated buffer.

The primary observed impact is unexpected system termination, consistent with a denial-of-service outcome. Out-of-bounds reads of this class can also leak adjacent memory contents when the read value influences observable program behavior. Apple has not disclosed the specific subsystem, and no public proof-of-concept is available at this time. The EPSS probability is 0.327%.

Root Cause

The root cause is missing or insufficient bounds validation before a memory read operation [CWE-125]. The fixed builds add explicit length or index checks so that reads cannot exceed the bounds of the target buffer. Apple's release notes for updates 128067, 128071, and 128072 document the corrective change.

Attack Vector

According to the CVE description, an installed application is the exploitation surface. A locally executing app crafts input that reaches the vulnerable code path and causes the out-of-bounds read, leading to system termination. Full technical details are described in prose because no verified public exploit or code sample exists. Refer to the Apple Security Update 128067, Apple Security Update 128071, and Apple Security Update 128072 advisories for vendor-provided technical context.

Detection Methods for CVE-2026-43757

Indicators of Compromise

Unexpected kernel panics or sudden reboots correlated with the execution of untrusted or newly installed applications.
Crash reports in /Library/Logs/DiagnosticReports/ referencing memory access faults during application activity.
Presence of unsigned or ad-hoc signed applications launched immediately before system termination events.

Detection Strategies

Monitor macOS endpoints for repeated panic events and correlate them with process execution telemetry.
Baseline application installations and flag executables that trigger crash-report generation on multiple hosts.
Hunt for anomalous process spawn patterns from user directories preceding system instability.

Monitoring Recommendations

Centralize macOS unified logs and DiagnosticReports for analytics on kernel and userland crashes.
Track macOS build versions across the fleet to identify systems still running versions prior to 15.7.8, 14.8.8, or 26.6.
Alert on newly signed or notarized application launches followed by system reboots within a short window.

How to Mitigate CVE-2026-43757

Immediate Actions Required

Apply Apple's security updates to reach macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Inventory all macOS endpoints and prioritize patching for systems running unsupported or outdated builds.
Restrict installation of untrusted applications through Gatekeeper policy and MDM configuration profiles.
Review recent crash reports on managed Macs to identify potential exploitation attempts before patch deployment.

Patch Information

Apple has published fixed builds in three advisories: Apple Security Update 128067, Apple Security Update 128071, and Apple Security Update 128072. Updates are delivered through the standard macOS Software Update channel and via MDM patch workflows.

Workarounds

Enforce application allow-listing so only vetted, signed applications can execute on managed endpoints.
Require Gatekeeper to block applications from unidentified developers until systems are updated.
Limit local user privileges to reduce the ability of standard users to install arbitrary applications.

bash

# Verify installed macOS version against fixed builds
sw_vers -productVersion

# Trigger a software update check via MDM or locally
sudo softwareupdate --list
sudo softwareupdate --install --all --restart