CVE-2026-43714 - Vulnerability Details

Description

The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.

Published: 2026-07-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Apple has identified an issue where input sanitization is insufficient, enabling a malicious application to read protected user data without needing elevated privileges. The flaw exists across several operating system releases and is fixed by the updates for iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, and watchOS 26.6. Attackers can exploit this to leak confidential data within the context of the compromised app.

Affected Systems

Apple iOS, iPadOS, macOS (Sequoia, Sonoma, Tahoe), visionOS, and watchOS are affected in all releases prior to the listed fixes.

Risk and Exploitability

The EPSS score is < 1 % and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or semi‑local through the installation of a malicious application that triggers the insufficient sanitization. No remote code execution or privilege escalation is indicated; the damage is limited to data leakage within the context of the compromised app.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

iOS and iPadOS

affected

Version	Status	Constraints
`0`	affected	< 18.7.10
`0`	affected	< 26.6

Apple

macOS

affected

Version	Status	Constraints
`0`	affected	< 14.8.8
`0`	affected	< 15.7.8
`0`	affected	< 26.6

Apple

visionOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Apple

watchOS

affected

Version	Status	Constraints
`0`	affected	< 26.6

Configuration 1 [-]

OR	cpe:2.3:o:apple:ipados::::::::
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:macos::::::::
	cpe:2.3:o:apple:visionos::::::::
	cpe:2.3:o:apple:watchos::::::::

No data.

Vendor Product Confidence Versions

Apple

Ios And Ipados

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Apple

Macos

100%

Version	Status	Scheme	Platform
`[0,14.8.8)`	affected	generic	—
`[0,15.7.8)`	affected	generic	—
`[0,26.6)`	affected	generic	—

Apple

Visionos

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Apple

Watchos

100%

Version	Status	Scheme	Platform
`[0,26.6)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update all Apple devices to the latest public release version that contains the fix (iOS 26.6, iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6).
Enable automatic system updates so that future patches are applied without manual intervention.
Restrict app installations to the Apple App Store and ensure developers are vetted; avoid sideloading or installing untrusted applications.

Generated by OpenCVE AI on August 17, 2026 at 23:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/128066
https://support.apple.com/en-us/128067
https://support.apple.com/en-us/128068
https://support.apple.com/en-us/128070
https://support.apple.com/en-us/128071
https://support.apple.com/en-us/128072
https://support.apple.com/en-us/148287

History

Mon, 17 Aug 2026 23:45:00 +0000

Type	Values Removed	Values Added
Title	Insufficient Input Sanitization Allowing Malicious App to Access Protected User Data

Mon, 17 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description	The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.	The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.
References		https://support.apple.com/en-us/148287

Tue, 04 Aug 2026 14:00:00 +0000

Type	Values Removed	Values Added
Title		Insufficient Input Sanitization Allowing Malicious App to Access Protected User Data

Mon, 03 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title	Improper Input Sanitization Enables Malicious App to Access Protected User Data
Weaknesses	CWE-200

Thu, 30 Jul 2026 01:30:00 +0000

Type	Values Removed	Values Added
Title		Improper Input Sanitization Enables Malicious App to Access Protected User Data
Weaknesses		CWE-200

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 02:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios And Ipados Apple macos Apple visionos Apple watchos
Vendors & Products		Apple Apple ios And Ipados Apple macos Apple visionos Apple watchos

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. A malicious app may be able to access protected user data.
References		https://support.apple.com/en-us/128066 https://support.apple.com/en-us/128067 https://support.apple.com/en-us/128068 https://support.apple.com/en-us/128070 https://support.apple.com/en-us/128071 https://support.apple.com/en-us/128072

Subscriptions

Apple Ios And Ipados Ipados Iphone Os Macos Visionos Watchos

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2026-07-27T20:12:35.520Z

Updated: 2026-08-17T21:29:40.506Z

Reserved: 2026-05-01T22:46:21.644Z

Link: CVE-2026-43714

Vulnrichment

Updated: 2026-07-28T14:46:08.904Z

NVD

Status : Modified

Published: 2026-07-27T21:16:55.523

Modified: 2026-08-17T22:17:07.830

Link: CVE-2026-43714

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-17T23:30:04Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object