CVE-2026-43688
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A memory corruption issue was addressed with improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.
Risk Assessment
An attacker could exploit this to cause app crashes (DoS) on the user's device, potentially disrupting system operation.
Recommendation
Update iOS, iPadOS, and macOS to the patched versions (iOS 27, iPadOS 27, macOS Golden Gate 27).
Other vulnerabilities in Apple operating systems
See all- CVE-2023-40403Medium
The issue was addressed with improved memory handling. It is fixed in macOS Ventura 13.6, tvOS 17, iOS 16.7 and iPadOS 16.7, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. Processing web content may disclose sensitive information.
- CVE-2026-64774Critical
An integer overflow vulnerability was addressed with improved input validation. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64772Critical
An out-of-bounds write issue was addressed with improved input validation. Affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64771Critical
A buffer overflow vulnerability was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64770Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64769Critical
An out-of-bounds write issue was addressed with improved bounds checking. The issue affects iOS, iPadOS, macOS, tvOS, and visionOS. A remote attacker may cause unexpected application termination or heap corruption.
- CVE-2026-64746Critical
An authorization issue was addressed with improved validation. Affects iOS, iPadOS, macOS, visionOS, and watchOS. An app may add contacts without user authorization.
- CVE-2026-64726Critical
The issue was addressed with improved memory handling. Affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An attacker in physical proximity may corrupt process memory.
- CVE-2026-43812Critical
A use after free issue was addressed with improved memory management. Affects iOS, iPadOS, macOS, tvOS, and visionOS. An app may cause unexpected system termination.
- CVE-2026-43809Critical
An out-of-bounds read was addressed with improved bounds checking. Affects iOS, iPadOS, macOS. An app may cause unexpected system termination.
Original NVD description (English source)
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS