CVE-2026-43791: Apple macOS Path Traversal Vulnerability

CVE-2026-43791 Overview

CVE-2026-43791 is an input validation vulnerability in Apple macOS that allows an app to read arbitrary files. Apple addressed the issue with improved input sanitization across three supported macOS releases. The flaw is categorized as a path traversal weakness [CWE-22] and affects the confidentiality of files accessible to the operating system.

Apple resolved the vulnerability in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. No public exploit code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A malicious application installed on a vulnerable macOS host can bypass path validation to read files outside its intended scope, exposing sensitive user or system data.

Affected Products

Apple macOS Tahoe prior to 26.7
Apple macOS Sequoia prior to 15.8
Apple macOS Golden Gate prior to 27

Discovery Timeline

2026-09-14 - CVE-2026-43791 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-43791

Vulnerability Analysis

CVE-2026-43791 stems from improper input sanitization in a macOS component that handles file path input. An installed application can supply crafted path data that the affected component fails to validate correctly. The result is arbitrary file read access outside the application's expected boundary.

Apple's advisory states that the issue was addressed with improved input sanitization. The vulnerability is classified as a path traversal weakness [CWE-22], where user-supplied path elements are not properly neutralized before being used in file system operations.

Apple has not published the specific component name, function, or code path involved. Refer to Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043 for the vendor advisories covering each macOS release train.

Root Cause

The root cause is missing or insufficient validation of path input passed to a privileged file access routine. When an application supplies path traversal sequences or otherwise malformed input, the routine resolves the path without confining it to the intended directory. This enables the application to reference files it should not have access to.

Attack Vector

Exploitation requires a malicious or compromised application running on the target macOS system. The attacker interacts with the vulnerable component through normal application interfaces, supplying crafted input that triggers the unsafe path resolution. Successful exploitation returns file contents to the attacker-controlled process without triggering standard authorization checks.

No verified proof-of-concept code has been published for CVE-2026-43791. See the Apple advisories linked above for vendor-supplied technical context.

Detection Methods for CVE-2026-43791

Indicators of Compromise

Unexpected file read access from third-party applications targeting paths outside their container or sandbox scope.
Applications issuing file system calls containing traversal sequences such as ../ against system or user directories.
Unusual access to sensitive files like ~/Library/Keychains, /etc, or files under other user home directories by non-privileged apps.

Detection Strategies

Enable macOS Endpoint Security framework telemetry to capture file open events with full path resolution.
Correlate application identifiers with the set of files they access, flagging deviations from historical baselines.
Alert on file read operations to protected paths that originate from applications lacking corresponding entitlements.

Monitoring Recommendations

Monitor macOS Unified Logs for file access events tied to non-system signed applications.
Track process-to-file relationships across the fleet and identify processes accessing files inconsistent with their function.
Review installed application inventory to identify unsigned or recently installed apps that could serve as the vulnerable actor.

How to Mitigate CVE-2026-43791

Immediate Actions Required

Update affected macOS endpoints to macOS Tahoe 26.7, macOS Sequoia 15.8, or macOS Golden Gate 27 as applicable to the installed release train.
Audit installed applications and remove untrusted or unnecessary third-party software that could be leveraged for exploitation.
Restrict user ability to install applications from unverified sources through Gatekeeper and MDM policy.

Patch Information

Apple released fixes in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Deployment details are documented in Apple Support Article #149035, Apple Support Article #149042, and Apple Support Article #149043. Administrators should push the update through Apple's Software Update mechanism or an MDM platform.

Workarounds

No vendor-supplied workaround exists. Apply the vendor patch as the primary remediation.
Enforce least-privilege application deployment and restrict installation of unsigned applications until patching completes.
Use MDM configuration profiles to block execution of applications not on an approved allowlist on unpatched hosts.

bash

# Verify the installed macOS version meets the patched build
sw_vers -productVersion

# Trigger a software update check via command line
sudo softwareupdate --install --all --restart