CVE-2026-43774: Apple macOS Information Disclosure Flaw

CVE-2026-43774 Overview

CVE-2026-43774 is an out-of-bounds read vulnerability [CWE-787] affecting multiple versions of Apple macOS. A local application can read beyond allocated buffer boundaries and access sensitive user data. Apple addressed the issue with improved bounds checking in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6.

The flaw requires local access and user interaction to exploit. It does not permit remote code execution or privilege escalation, but successful exploitation exposes confidential process memory contents. Apple published corresponding advisories on its support portal.

Critical Impact
A malicious application running locally on an affected macOS system can read out-of-bounds memory and disclose sensitive user data from other processes or the kernel.

Affected Products

Apple macOS Sequoia prior to 15.7.8
Apple macOS Sonoma prior to 14.8.8
Apple macOS Tahoe prior to 26.6

Discovery Timeline

2026-07-27 - CVE-2026-43774 published to the National Vulnerability Database
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-43774

Vulnerability Analysis

CVE-2026-43774 is classified as an out-of-bounds read weakness under [CWE-787]. The affected macOS component fails to validate buffer boundaries before performing a read operation. An application that reaches the vulnerable code path can read memory outside the intended buffer.

The returned data may include sensitive information belonging to other processes, kernel structures, or the OS itself. Exploitation requires local code execution on the target Mac and some user interaction, according to the CVSS vector. The confidentiality impact is high, but integrity and availability are not affected.

Apple's advisories confirm the fix is a bounds-checking improvement in the vulnerable routine. Apple has not disclosed the specific subsystem or symbol involved.

Root Cause

The underlying defect is missing or insufficient boundary validation before a memory read. When an application supplies input that drives the read offset or length, the routine dereferences memory past the end of the intended buffer. Apple corrected the logic by adding explicit bounds checks in the fixed builds.

Attack Vector

An attacker must first execute a crafted application on the target Mac. The application invokes the affected macOS interface with parameters that trigger the out-of-bounds read. The returned buffer contents include adjacent memory that the application would not otherwise be authorized to read.

Because the CVSS vector specifies user interaction is required, exploitation typically depends on the user running the malicious app or opening a crafted file that the app processes. See the Apple Security Update Advisory for scope details.

Detection Methods for CVE-2026-43774

Indicators of Compromise

Unsigned or ad-hoc signed applications launching shortly before unexpected access to system frameworks or IPC endpoints
macOS crash reports referencing EXC_BAD_ACCESS or KERN_INVALID_ADDRESS in the vulnerable component, indicating exploit development or failed attempts
Unexpected reads or copies of files under ~/Library or Keychain-related paths following execution of a newly installed app

Detection Strategies

Monitor endpoint telemetry for execution of untrusted binaries followed by attempts to read memory or files outside the app's declared entitlements
Alert on macOS versions running below patched builds (sw_vers -productVersion reporting below 15.7.8, 14.8.8, or 26.6)
Correlate Gatekeeper and XProtect events with subsequent sensitive-data access to identify suspicious application behavior

Monitoring Recommendations

Ingest Unified Log events from macOS endpoints and search for repeated crashes in the same framework across multiple hosts
Track application signing status and notarization state for new binaries executed by end users
Baseline expected access patterns to sensitive user directories and alert on deviations

How to Mitigate CVE-2026-43774

Immediate Actions Required

Upgrade affected endpoints to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6
Inventory macOS devices using MDM to identify hosts still running vulnerable builds
Restrict installation of unsigned or non-notarized applications through Gatekeeper policy

Patch Information

Apple released fixes in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Deploy the updates through Software Update or your MDM platform. Reference the vendor advisories: Apple Security Update 128067, Apple Security Update 128071, and Apple Security Update 128072.

Workarounds

No official workaround exists; patching is the only supported remediation
Limit installation of untrusted third-party applications until updates are applied
Enforce least-privilege user accounts to reduce the sensitivity of data reachable by local apps

bash

# Verify the installed macOS build meets the patched version
sw_vers -productVersion

# Trigger a Software Update check
sudo softwareupdate --list
sudo softwareupdate --install --all --restart