CVE-2026-43753

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in Apple iOS and macOS

Publication date: 2026-07-27

Last updated on: 2026-07-28

Assigner: Apple Inc.

Description

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-28

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-15

NVD

CVE-2026-43753

EUVD

EUVD-2026-49514

Affected Vendors & Products

Vendor	Product	Version / Range
apple	macos	From 14.0 (inc) to 14.8.8 (exc)
apple	macos	From 15.0 (inc) to 15.7.8 (exc)
apple	macos	From 26.0 (inc) to 26.6 (exc)
apple	ipados	to 26.6 (exc)
apple	iphone_os	to 26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability caused by insufficient bounds checking. An attacker with physical access to a locked device could exploit this to read sensitive user information from memory locations outside the intended range.

Detection Guidance

This vulnerability requires physical access to a locked device and cannot be detected remotely via network commands. Ensure your device is updated to iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 to address the issue.

Impact Analysis

If an attacker gains physical access to your locked device, they may be able to view sensitive data such as passwords, messages, or other private information stored in memory without unlocking the device.

Compliance Impact

The vulnerability allows an attacker with physical access to a locked device to view sensitive user information due to an out-of-bounds read issue. This could potentially lead to unauthorized access to personal data, which may impact compliance with GDPR and HIPAA if such data includes protected health or personal information.

Mitigation Strategies

Update your device to the latest versions: iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6. Avoid leaving devices unattended in locked states.

Hi! I’m here to help you understand CVE-2026-43753. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70