CVE-2026-43747

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in macOS Sequoia

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: Apple Inc.

Description

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Parsing a maliciously crafted file may lead to an unexpected app termination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-43747

EUVD

EUVD-2026-49423

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 14.0 (inc) to 14.8.8 (exc)
apple	macos	From 15.0 (inc) to 15.7.8 (exc)
apple	macos	From 26.0 (inc) to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability caused by insufficient bounds checking when parsing files. A maliciously crafted file could trigger this flaw, potentially causing an application to terminate unexpectedly.

Detection Guidance

This vulnerability involves an out-of-bounds read issue in macOS versions. Detection primarily requires checking your macOS version against the patched releases: Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6. Use the command 'sw_vers' to check your current macOS version. If your version is older than the patched releases, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could lead to unexpected app crashes when opening a specially crafted file. It does not appear to allow code execution or data theft based on the provided description.

Compliance Impact

This vulnerability involves an out-of-bounds read that could cause unexpected app termination when parsing maliciously crafted files. It does not directly impact data confidentiality, integrity, or availability in a way that would violate GDPR or HIPAA requirements. However, if exploited, it could lead to denial-of-service conditions affecting system availability, which may indirectly impact compliance with availability-focused controls in these regulations.

Mitigation Strategies

Update to the latest patched versions of macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 to address the out-of-bounds read vulnerability.

Hi! I’m here to help you understand CVE-2026-43747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70