CVE-2026-43790: Apple macOS Buffer Overflow Vulnerability

CVE-2026-43790 Overview

CVE-2026-43790 is a memory corruption vulnerability affecting multiple versions of Apple macOS. A remote attacker can trigger unexpected system termination or corrupt kernel memory without authentication or user interaction. Apple addressed the flaw with improved memory handling in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. The issue is categorized as an out-of-bounds write [CWE-787] and carries a network attack vector with high impact on integrity and availability.

Critical Impact
A remote, unauthenticated attacker can corrupt kernel memory or terminate the operating system, undermining the integrity and availability of affected macOS hosts.

Affected Products

Apple macOS versions prior to Golden Gate 27
Apple macOS Sequoia versions prior to 15.8
Apple macOS Tahoe versions prior to 26.7

Discovery Timeline

2026-09-14 - CVE-2026-43790 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-43790

Vulnerability Analysis

The vulnerability resides in a macOS component that handles data received over the network. Apple's advisories describe the fix as improved memory handling, indicating that the pre-patch code failed to validate memory boundaries before performing write operations. Successful exploitation results in kernel memory corruption or unexpected system termination.

Because the flaw is reachable remotely and requires no privileges or user interaction, it can be triggered by crafted network traffic sent to a vulnerable host. The impact profile prioritizes integrity and availability rather than confidentiality, consistent with a kernel-level write primitive that damages system state without necessarily leaking data.

Root Cause

The underlying weakness is an out-of-bounds write [CWE-787]. The affected code path writes attacker-influenced data past the end of an allocated buffer, corrupting adjacent kernel memory structures. Apple resolved the defect by tightening memory handling logic in the impacted component.

Attack Vector

An attacker sends malformed input to a network-facing service on the target macOS system. Processing that input triggers the out-of-bounds write, which either crashes the kernel or overwrites in-memory structures that the kernel relies on. No verified public exploit code or proof-of-concept has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

See the Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043 for vendor-supplied technical context.

Detection Methods for CVE-2026-43790

Indicators of Compromise

Unexpected kernel panics or reboots on macOS hosts, particularly clusters of panics correlated with specific network peers.
Panic logs in /Library/Logs/DiagnosticReports/ referencing memory corruption, invalid page faults, or the affected kernel subsystem.
Anomalous inbound network flows targeting macOS endpoints from untrusted sources immediately preceding host instability.

Detection Strategies

Inventory macOS build versions across the fleet and flag hosts running versions earlier than Golden Gate 27, Sequoia 15.8, or Tahoe 26.7.
Correlate crash telemetry with network connection logs to identify remote sources that consistently precede system termination.
Deploy network intrusion detection signatures for known-malformed traffic patterns against Apple services as they become available from vendors.

Monitoring Recommendations

Forward macOS unified logs and diagnostic reports to a centralized analytics platform for correlation.
Alert on repeated unscheduled reboots of macOS endpoints within short time windows.
Monitor for unusual inbound connections to macOS systems from external or lateral sources.

How to Mitigate CVE-2026-43790

Immediate Actions Required

Upgrade affected systems to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 without delay.
Prioritize patching internet-exposed macOS hosts and systems reachable from untrusted network segments.
Validate patch deployment by confirming the OS build version on every managed macOS endpoint.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Refer to the vendor advisories for exact build identifiers and applicability: Apple Support Document #149035, Apple Support Document #149042, and Apple Support Document #149043.

Workarounds

Restrict inbound network exposure of macOS hosts using host and perimeter firewalls until patches are applied.
Disable or firewall off unused network services on macOS endpoints to reduce the reachable attack surface.
Segment macOS systems from untrusted networks and enforce least-privilege network access policies.

bash

# Verify the installed macOS product version on a host
sw_vers -productVersion

# Trigger the software update check to pull the vendor-supplied fix
sudo softwareupdate --list
sudo softwareupdate --install --all --restart