CVE-2026-43771: Apple macOS Stack Overflow DoS Vulnerability

CVE-2026-43771 Overview

CVE-2026-43771 is a stack overflow vulnerability [CWE-121] affecting multiple versions of Apple macOS. The flaw stems from insufficient input validation in an unspecified system component. A local application can trigger the stack overflow to cause a denial-of-service condition on the affected system. Apple addressed the issue through improved input validation in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Successful exploitation requires local access and user interaction, limiting the vulnerability to scenarios where an attacker can convince a user to run a malicious application.

Critical Impact
A malicious local application can crash macOS system components, disrupting availability and impacting user productivity until the affected process or system is restarted.

Affected Products

Apple macOS Sequoia versions prior to 15.7.8
Apple macOS Sonoma versions prior to 14.8.8
Apple macOS Tahoe versions prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43771 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43771

Vulnerability Analysis

CVE-2026-43771 is a stack-based buffer overflow classified under [CWE-121]. The vulnerability resides in a macOS component that fails to properly validate the size or structure of input before writing it onto the stack. When a local application supplies crafted input, the overflow corrupts adjacent stack memory, including return addresses and saved frame pointers. According to Apple's advisory, the practical impact is denial-of-service, meaning the affected process or subsystem terminates rather than yielding arbitrary code execution. Confidentiality impact is rated high in the CVSS vector because memory contents may be exposed during the fault handling path, while availability impact reflects the process crash.

Root Cause

The root cause is missing or insufficient bounds checking on data written to a fixed-size stack buffer. Apple's advisory states the issue was addressed with improved input validation, indicating the fix introduces length or format checks before the vulnerable copy operation. This class of defect typically arises when developers assume trusted callers or fixed-size inputs without enforcing runtime constraints.

Attack Vector

Exploitation requires local access to the target macOS system and user interaction, consistent with the CVSS attack vector AV:L/UI:R. An attacker must deliver a malicious application to the victim, who must then execute it. Once running, the application invokes the vulnerable code path with attacker-controlled input to trigger the stack overflow. No network exploitation path exists, and no elevated privileges are required to run the triggering process.

See the Apple Security Advisory #128067, Apple Security Advisory #128071, and Apple Security Advisory #128072 for vendor guidance.

Detection Methods for CVE-2026-43771

Indicators of Compromise

Unexpected crashes of macOS system daemons or user-facing processes, with crash reports referencing stack corruption or EXC_BAD_ACCESS in /Library/Logs/DiagnosticReports/.
Repeated launches of unsigned or ad-hoc signed applications immediately preceding process termination events.
Presence of unknown application bundles in user-writable directories such as ~/Downloads or ~/Library/Application Support.

Detection Strategies

Monitor macOS Unified Logging for ReportCrash events correlated with a specific parent application to identify repeated denial-of-service attempts.
Track execution of unsigned binaries using endpoint telemetry from tools such as ESF (Endpoint Security Framework) subscribers.
Baseline expected crash rates for system processes and alert on statistical anomalies tied to a single user session.

Monitoring Recommendations

Ingest macOS crash reports and process execution events into a centralized logging platform for retention and correlation.
Alert on execution of newly introduced binaries from user-writable paths that trigger subsequent system process crashes.
Review Gatekeeper and XProtect logs for blocked or bypassed application launches.

How to Mitigate CVE-2026-43771

Immediate Actions Required

Apply the vendor updates: upgrade to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as appropriate for the deployed release train.
Inventory macOS endpoints across the environment and identify systems running unpatched builds using MDM reporting.
Restrict installation of untrusted applications through Gatekeeper policy and application allowlisting.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Refer to Apple Security Advisory #128067, Apple Security Advisory #128071, and Apple Security Advisory #128072 for the complete list of addressed issues and installation guidance.

Workarounds

Enforce Gatekeeper in its default configuration to block execution of unsigned or unnotarized applications.
Deploy MDM configuration profiles that restrict application installation to approved sources only.
Educate users to avoid executing applications received from untrusted email attachments, messaging platforms, or web downloads.

bash

# Verify installed macOS version and confirm patch status
sw_vers -productVersion

# Trigger a software update check via command line
sudo softwareupdate --list
sudo softwareupdate --install --all --restart