CVE-2026-43773: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43773 Overview

CVE-2026-43773 is an out-of-bounds read vulnerability [CWE-125] in Apple macOS disk image handling. Mounting a maliciously crafted disk image can trigger unexpected system termination or corrupt kernel memory. Apple resolved the issue with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.

The flaw affects kernel-level code that parses disk image structures, making successful exploitation a path to kernel memory corruption. The National Vulnerability Database (NVD) assigns a CVSS 3.1 base score of 9.8.

Critical Impact
A crafted disk image mounted on an unpatched macOS host can crash the system or corrupt kernel memory, undermining kernel integrity guarantees.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43773 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-43773

Vulnerability Analysis

The vulnerability resides in the macOS disk image mounting subsystem. When the kernel parses metadata from a disk image, it reads beyond the bounds of an allocated buffer. The out-of-bounds read exposes adjacent kernel memory or causes an invalid memory access that terminates the system.

Because disk image parsing runs in privileged kernel context, the flaw impacts confidentiality, integrity, and availability. An attacker who convinces a user or automated process to mount a crafted image gains a primitive that can leak kernel memory or destabilize the operating system. Chained with additional flaws, the primitive could support broader kernel exploitation.

Apple describes the fix as "improved bounds checking," which indicates the corrected code validates offsets or lengths against allocation size before dereference.

Root Cause

The root cause is missing or insufficient bounds validation on attacker-controlled fields inside a disk image structure. The parser trusts length or offset values from the image and reads memory beyond the allocated buffer, satisfying the definition of [CWE-125] Out-of-Bounds Read.

Attack Vector

Exploitation requires the target to mount a malicious disk image such as a .dmg file. Delivery channels include drive-by downloads, phishing attachments, removable media, and network shares that auto-mount image files. No prior authentication is required on the target system, and user interaction is limited to the mount action itself, which many workflows perform automatically.

No public proof-of-concept exploit is available for CVE-2026-43773, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072 for vendor technical guidance.

Detection Methods for CVE-2026-43773

Indicators of Compromise

Unexpected kernel panics or system reboots on macOS endpoints correlated with mounting of disk image files.
Presence of unsolicited .dmg, .iso, or .sparseimage files delivered via email, download, or removable media.
diskimages-helper or hdiutil process activity referencing untrusted paths shortly before a crash.

Detection Strategies

Monitor endpoint telemetry for disk image mount events originating from user download directories or temporary paths.
Correlate macOS PanicReporter and ReportCrash artifacts with recent disk image mount operations.
Alert on macOS versions below 15.7.8, 14.8.8, or 26.6 detected in asset inventory scans.

Monitoring Recommendations

Ingest macOS unified logs filtered on com.apple.diskimages and hdiutil for anomaly review.
Track email and web gateway logs for inbound disk image file types and quarantine unexpected samples.
Baseline normal mount behavior for managed fleets and flag deviations such as mounts from browser download folders.

How to Mitigate CVE-2026-43773

Immediate Actions Required

Upgrade all macOS endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6.
Prioritize patching on developer, executive, and administrator workstations that routinely handle disk images.
Block inbound .dmg, .iso, and .sparseimage attachments at email and web gateways until endpoints are patched.

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Deployment guidance is documented in Apple Support Article #128067, Apple Support Article #128071, and Apple Support Article #128072. Deploy through Apple Software Update, Mobile Device Management (MDM), or Munki-style tooling.

Workarounds

Instruct users not to open or mount disk image files from untrusted sources until patches are applied.
Use MDM configuration profiles to restrict mounting of external and downloaded disk images where feasible.
Enforce Gatekeeper and File Quarantine to require user confirmation before opening images downloaded from the internet.

bash

# Verify current macOS build against the fixed versions
sw_vers -productVersion

# Trigger available Apple software updates (requires admin)
sudo softwareupdate --install --all --restart