CVE-2026-43803
A critical vulnerability allows a remote attacker to cause a system crash by writing outside the bounds of an array. The flaw has been fixed in recent releases of Apple operating systems.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apple devices running iOS, iPadOS, macOS (Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6), tvOS, visionOS, or watchOS that are not updated to the specified versions.
Real-world impact
An attacker could crash the device, potentially leading to denial of service or enabling further attacks if the crash is part of a larger exploit chain.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability.
What to do about it
- 011. Update your device to iOS 26.6 or later, or the equivalent version for your platform (iPadOS, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6).
- 022. Restart the device after the update.
NVD-referenced vendor advisory
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- support.apple.com/en-us/128066release notesvendor advisory
- support.apple.com/en-us/128067release notesvendor advisory
- support.apple.com/en-us/128068release notesvendor advisory
- support.apple.com/en-us/128069release notesvendor advisory
- support.apple.com/en-us/128070release notesvendor advisory
- support.apple.com/en-us/128071release notesvendor advisory
- support.apple.com/en-us/128072release notesvendor advisory