Critical· 9.8official fix available
CVE-2026-43807
CVE-2026-43807 is a critical buffer overflow vulnerability (CWE-120) in Apple's operating systems. It allows a malicious accessory to cause unexpected app termination. Fixed in updates to iOS 26.5.2, iPadOS 26.5.2, macOS 15.7.8, 14.8.8, Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, and watchOS 26.6.
publishedJul 27, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
41th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 27, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Apple iOS, iPadOS, macOS, tvOS, visionOS, and watchOS users
02
Real-world impact
A malicious accessory could exploit this to terminate apps unexpectedly, potentially disrupting functionality or causing data loss.
03
Why this severity
CVSS 9.8 (critical): High confidence in remote exploitation without user interaction, leading to full system compromise.
04
What to do about it
official fix available
recommended steps
- 011. Upgrade iOS to version 26.5.2 or later.
- 022. Upgrade iPadOS to version 26.5.2 or later.
- 033. Upgrade macOS Sequoia to version 15.7.8 or later.
- 044. Upgrade macOS Sonoma to version 14.8.8 or later.
- 055. Upgrade macOS Tahoe to version 26.5.2 or later.
- 066. Upgrade tvOS to version 26.6 or later.
- 077. Upgrade visionOS to version 26.6 or later.
- 088. Upgrade watchOS to version 26.6 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 27, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
References & advisories
- support.apple.com/en-us/127594release notesvendor advisory
- support.apple.com/en-us/127595release notesvendor advisory
- support.apple.com/en-us/128068release notesvendor advisory
- support.apple.com/en-us/128069release notesvendor advisory
- support.apple.com/en-us/128070release notesvendor advisory
- support.apple.com/en-us/128071release notesvendor advisory
- support.apple.com/en-us/128072release notesvendor advisory
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →