Description
An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may lead to unexpected app termination.
Published: 2026-09-14
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Application Crash)
Action: Apply Update
AI Analysis

Impact

The vulnerability is an out-of-bounds write that is fixed by removing the vulnerable code path. When a client connects to a malicious WebDAV server, the corrupted memory write can cause the associated application to terminate unexpectedly, resulting in a denial‑of‑service condition. This is an instance of an out‑of‑bounds write (CWE‑122).

Affected Systems

Apple macOS is impacted, with the fix applied in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Older releases remain vulnerable as the issue has not been patched there.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in CISA KEV, so the current exploitation likelihood is unclear. The CVSS score is not provided, but the flaw is triggered by a remote connection to a malicious WebDAV server, implying a remote attack vector. Users running older macOS releases should prioritize updating to the fixed versions to mitigate the risk.

Generated by OpenCVE AI on September 15, 2026 at 09:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update macOS to macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 where the vulnerable code has been removed.
  • Disable or block WebDAV services on the local machine or firewall to prevent the flawed WebDAV handling from being triggered.
  • Ensure that any third‑party applications that use WebDAV are also updated to recent releases that incorporate the same code removal.

Generated by OpenCVE AI on September 15, 2026 at 09:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 15 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
Title Out-of-Bounds Write in macOS WebDAV Handler Leading to Unexpected App Termination
Weaknesses CWE-122

Tue, 15 Sep 2026 02:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious WebDAV server may lead to unexpected app termination.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-15T13:02:30.214Z

Reserved: 2026-05-01T22:46:21.641Z

Link: CVE-2026-43677

cve-icon Vulnrichment

Updated: 2026-09-15T13:02:22.121Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:07.010

Modified: 2026-09-15T19:25:31.507

Link: CVE-2026-43677

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T09:30:08Z

Weaknesses