Description
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.
Published: 2026-09-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A validation flaw caused by inadequate input sanitization allows an attacker to trigger arbitrary code execution or unexpected termination of an application. The weakness is a classic improper input handling problem (CWE‑20). The vulnerability can be exercised remotely by delivering specially crafted data to the affected application, which may run arbitrary code with the app’s privileges.

Affected Systems

Apple macOS systems running versions earlier than macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 are impacted. All preceding releases of these macOS lines remain vulnerable until updated.

Risk and Exploitability

With a CVSS score of 8.8 the severity is high, but the EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a crafted payload could lead to code execution on the host if the vulnerability is triggered.

Generated by OpenCVE AI on September 20, 2026 at 20:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the macOS installation to macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or a later release that includes the fix.
  • If an immediate update cannot be performed, restrict the application’s exposure to external input, apply sandboxing settings, and disable any features that accept untrusted data.
  • Monitor system logs for abnormal application crashes or manifestation of unexpected termination that could signal exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Improper Input Handling in macOS

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Improper Input Validation Enables Arbitrary Code Execution in macOS

Tue, 15 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Tue, 15 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Title Improper Input Validation Enables Arbitrary Code Execution in macOS

Tue, 15 Sep 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos

Mon, 14 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.
References

Subscriptions

Apple Macos
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-09-15T03:56:32.940Z

Reserved: 2026-05-01T22:46:21.642Z

Link: CVE-2026-43692

cve-icon Vulnrichment

Updated: 2026-09-14T22:58:39.543Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-14T21:17:08.550

Modified: 2026-09-15T19:23:28.993

Link: CVE-2026-43692

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T21:00:05Z

Weaknesses
  • CWE-20

    Improper Input Validation