CVE-2026-43785: Apple iPadOS Privilege Escalation Vulnerability

CVE-2026-43785 Overview

CVE-2026-43785 is an authorization flaw affecting multiple Apple operating systems. The vulnerability allows an app to modify a file it only had permission to read. Apple addressed the issue with additional permission restrictions across iOS, iPadOS, macOS, tvOS, and visionOS.

The root cause maps to CWE-863: Incorrect Authorization, where the operating system enforced read access but did not consistently block write operations on the same resource. Exploitation requires local access and low-privilege execution, but no user interaction.

Critical Impact
A local app can tamper with files it should only be able to read, breaking file integrity guarantees enforced by the sandbox and permission model.

Affected Products

Apple iOS and iPadOS (fixed in iOS 27 and iPadOS 27)
Apple macOS (fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7)
Apple tvOS 27 and visionOS 27

Discovery Timeline

2026-09-14 - CVE-2026-43785 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-43785

Vulnerability Analysis

The flaw is an incorrect authorization issue in Apple's file access enforcement. An application granted read-only permission on a file could invoke code paths that resulted in the file being written or modified. The confidentiality boundary held, but the integrity boundary did not.

This pattern typically arises when one component checks permissions during open or path resolution, while a later component performs a write operation without re-validating the caller's authorization scope. Apple's fix adds explicit restrictions to close that gap.

Root Cause

The root cause is inconsistent enforcement of file permission semantics inside Apple's operating system components. A read grant did not reliably prevent subsequent write actions on the same file handle or path. The remediation, per Apple's advisories, was to apply additional permission checks so that read-only callers cannot reach mutating code paths.

Attack Vector

Exploitation is local. An attacker must run code on the target device, typically through a signed or sideloaded application. The malicious app requests or is granted read access to a target file, such as a shared preference, cache, or configuration artifact belonging to another app or system component. It then abuses the mismatched enforcement to write to that file, corrupting or repurposing its contents.

Because impact is limited to integrity, the practical exploitation goal is data tampering: modifying application state, injecting attacker-controlled content into files consumed by higher-privileged processes, or disabling security-relevant settings enforced through on-disk configuration.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. See the Apple Support Document #149034 for vendor details.

Detection Methods for CVE-2026-43785

Indicators of Compromise

Unexpected modification timestamps on files that should be read-only for the modifying process context.
Application containers or Group Container files altered by processes that lack a write entitlement.
Sandbox violation log entries related to file write operations preceding the patched OS versions.

Detection Strategies

Baseline file integrity of sensitive configuration and preference files on macOS endpoints and alert on drift.
Correlate process execution telemetry with file write events to identify writes from processes that only requested read access.
Track installed OS build versions across the fleet and flag devices running builds earlier than iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27.

Monitoring Recommendations

Enable Endpoint Security framework event collection for ES_EVENT_TYPE_NOTIFY_WRITE and ES_EVENT_TYPE_NOTIFY_RENAME on macOS to spot anomalous mutations.
Monitor unified logs for sandbox and tccd denial messages that may indicate an app probing for writable paths.
Alert on newly installed applications requesting broad file access shortly after installation.

How to Mitigate CVE-2026-43785

Immediate Actions Required

Update all Apple devices to iOS 27, iPadOS 27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, tvOS 27, or visionOS 27.
Prioritize devices that install third-party or sideloaded applications, since exploitation requires local code execution.
Review installed applications and remove any that are untrusted or no longer required.

Patch Information

Apple resolved CVE-2026-43785 by adding additional permission restrictions in the affected components. Fixed builds are documented in Apple Support Documents #149034, #149035, #149036, #149038, #149042, and #149043. Administrators managing devices through MDM should push the corresponding OS updates as forced installs.

Workarounds

No vendor-supplied workaround exists; updating to a fixed OS build is the only supported remediation.
Restrict app installation to vetted sources and enforce MDM policies that limit sideloading on managed devices.
Apply the principle of least privilege to file-sharing configurations so that sensitive files are not exposed to untrusted apps in the first place.

bash

# Verify macOS build version meets the fixed release
sw_vers -productVersion

# Trigger a software update check on macOS
sudo softwareupdate --list
sudo softwareupdate --install --all --restart