CVE-2026-43692

Remote Code Execution via Improper Input Handling in macOS

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.

Analysis

AI-generated

Technical impact

A validation flaw caused by inadequate input sanitization allows an attacker to trigger arbitrary code execution or unexpected termination of an application. The weakness is a classic improper input handling problem (CWE‑20). The vulnerability can be exercised remotely by delivering specially crafted data to the affected application, which may run arbitrary code with the app’s privileges.

Affected Systems

Apple macOS systems running versions earlier than macOS Golden Gate 27, macOS Sequoia 15.8, or macOS Tahoe 26.7 are impacted. All preceding releases of these macOS lines remain vulnerable until updated.

Risk and Exploitability

With a CVSS score of 8.8 the severity is high, but the EPSS score of less than 1 % indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a crafted payload could lead to code execution on the host if the vulnerability is triggered.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the macOS installation to macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or a later release that includes the fix.
  • If an immediate update cannot be performed, restrict the application’s exposure to external input, apply sandboxing settings, and disable any features that accept untrusted data.
  • Monitor system logs for abnormal application crashes or manifestation of unexpected termination that could signal exploitation attempts.

Generated by OpenCVE AI on September 20, 2026 at 20:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Remote Code Execution via Improper Input Handling in macOS
Type Values Removed Values Added
Title Improper Input Validation Enables Arbitrary Code Execution in macOS
Type Values Removed Values Added
CPEs cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Title Improper Input Validation Enables Arbitrary Code Execution in macOS
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Apple
Apple macos
Vendors & Products Apple
Apple macos
Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution.
References
Earlier changes (3)
Weaknesses
  • CWE-20

    Improper Input Validation

Sources

Status
PUBLISHED
Assigner
apple
Published
Updated
Oct 26, 2026, 8:35 PM
Reserved
May 1, 2026, 10:46 PM

View source JSON

Updated
Sep 14, 2026, 10:58 PM

JSON

Status
Analyzed
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 15, 2026, 7:23 PM

View source JSON

No data.

Updated
Sep 20, 2026, 9:00 PM

JSON