CVE-2026-43761: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43761 Overview

CVE-2026-43761 is an out-of-bounds write vulnerability [CWE-787] in Apple macOS disk image handling. Mounting a malicious disk image can trigger unexpected system termination, resulting in a denial-of-service condition. Apple addressed the flaw with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The vulnerability requires user interaction to mount the crafted image but no authentication, and the attack vector is network-based when the image is delivered remotely. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
Attackers can crash macOS systems by convincing users to mount specially crafted disk images, disrupting availability on unpatched hosts.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-09-14 - CVE-2026-43761 published to the National Vulnerability Database
2026-09-15 - Last updated in the NVD database

Technical Details for CVE-2026-43761

Vulnerability Analysis

The flaw resides in the macOS component responsible for parsing and mounting disk image files such as DMG containers. When the operating system processes a malformed image, it writes past the boundaries of an allocated buffer. This out-of-bounds write corrupts adjacent kernel or process memory, producing an unexpected system termination. Apple's fix introduces stricter bounds checking on the affected code path. The vulnerability affects availability only, with no reported impact to confidentiality or integrity. Users must be persuaded to mount the malicious image, which limits automated exploitation.

Root Cause

The root cause is missing or insufficient bounds validation while parsing structures within a disk image file. Attacker-controlled length or offset fields drive a write operation beyond the intended buffer. This class of defect is tracked as [CWE-787] Out-of-Bounds Write.

Attack Vector

An attacker delivers a crafted disk image through phishing, a compromised website, a shared file store, or removable media. When the user double-clicks or otherwise triggers a mount, macOS parses the image and reaches the vulnerable code path. The resulting memory corruption causes the system to terminate. Because macOS often auto-mounts downloaded DMG files on user action, delivery through browser-based social engineering is realistic. No privilege is required on the target system beyond the ability to mount an image.

Refer to Apple's advisories for technical specifics: Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072.

Detection Methods for CVE-2026-43761

Indicators of Compromise

Unexpected kernel panics or system reboots shortly after a user mounts a .dmg or related image file.
Presence of untrusted disk image files delivered by email, chat, or web download prior to a crash event.
Diagnostic reports under /Library/Logs/DiagnosticReports/ referencing diskimages-helper or DiskImages frameworks around the time of failure.

Detection Strategies

Correlate macOS unified log entries from com.apple.diskimages with recent file downloads to identify suspicious mount attempts.
Alert on process executions of hdiutil attach or diskimages-helper originating from browser download directories.
Track panic logs and match them to recently mounted image hashes to identify malicious payloads.

Monitoring Recommendations

Ingest macOS endpoint telemetry, including process, file, and crash artifacts, into a centralized analytics platform for correlation.
Monitor for repeated mount-and-crash patterns across multiple endpoints that may indicate a coordinated campaign.
Track macOS build versions across the fleet to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-43761

Immediate Actions Required

Update affected systems to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 without delay.
Instruct users to avoid mounting disk images received from untrusted sources or unexpected senders.
Inventory macOS endpoints and prioritize patching for internet-facing and executive-user devices.

Patch Information

Apple released fixes with improved bounds checking. Consult the vendor advisories for release notes and package details: Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072.

Workarounds

Block or quarantine .dmg, .iso, and related disk image attachments at the email gateway when business use cases allow.
Configure browsers to prompt before downloading disk image files and disable automatic opening of safe files in Safari.
Restrict mounting of external disk images through mobile device management policies where operational requirements permit.

bash

# Verify current macOS version on an endpoint
sw_vers

# Disable automatic opening of "safe" downloads in Safari to reduce auto-mount risk
defaults write com.apple.Safari AutoOpenSafeDownloads -bool false