What is the CVSS score of CVE-2026-43653?

CVE-2026-43653 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43653?

Yes, a patch is available for CVE-2026-43653. Update the affected software to the latest version immediately.

Apple iOS iPadOS CVE-2026-43653

EUVD-2026-29299 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-11 apple

GHSA-mp3c-q886-fvqv

Denial Of Service Apple Tvos Ios And Ipados

6.2

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Description specifies local-network adjacency (AV:A), DoS-only impact (A:H), no confidentiality or integrity effect, and no authentication required.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:38 vuln.today

CVSS changed

May 12, 2026 - 19:22 NVD

6.2 (MEDIUM)

Patch available

May 11, 2026 - 22:18 EUVD

CVE Published

May 11, 2026 - 20:08 nvd

MEDIUM 6.2

CVE Published

May 11, 2026 - 20:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5. An attacker on the local network may be able to cause a denial-of-service.

AnalysisAI

Uncontrolled resource consumption in Apple iOS, iPadOS, macOS, and tvOS allows an adjacent local-network attacker to trigger a denial-of-service condition through a memory handling flaw. Affected platforms include iOS and iPadOS prior to 18.7.9 and 26.5, macOS Sonoma prior to 14.8.7, macOS Tahoe prior to 26.5, and tvOS prior to 26.5. No public exploit code exists and CISA has not added this to the Known Exploited Vulnerabilities catalog; EPSS probability is 0.02%, consistent with SSVC's 'exploitation: none' assessment.

Technical ContextAI

CWE-400 (Uncontrolled Resource Consumption) indicates the root cause is a failure to bound memory allocation or consumption in response to network-sourced input, leading to resource exhaustion and service disruption. Apple's advisory language - 'addressed with improved memory handling' - confirms a memory management defect in a network-facing component. Affected CPE entries cover cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, and cpe:2.3:a:apple:tvos across versions prior to the fixed releases. The attack vector in the description ('attacker on the local network') points to an adjacency-scoped network service or protocol handler - likely a system daemon, Bonjour/mDNS stack, AirDrop handler, or similar local-link service - that fails to safely handle malformed or oversized inputs.

RemediationAI

Vendor-released patches are available. Update iOS and iPadOS to version 18.7.9 or 26.5, macOS Sonoma to 14.8.7, macOS Tahoe to 26.5, and tvOS to 26.5 via the standard software update mechanisms. Apple advisory URLs: https://support.apple.com/en-us/127110 (iOS/iPadOS 18.7.9), https://support.apple.com/en-us/127111 (iOS/iPadOS 26.5), https://support.apple.com/en-us/127115 (macOS Sonoma 14.8.7), https://support.apple.com/en-us/127117 (macOS Tahoe 26.5), https://support.apple.com/en-us/127118 (tvOS 26.5). If immediate patching is not possible, restricting untrusted devices from joining the same local network segment as Apple devices (e.g., isolating Apple devices on a separate VLAN or Wi-Fi SSID) reduces the attack surface, since exploitation requires adjacent-network access. Note that such segmentation may disrupt legitimate AirDrop, AirPlay, or Bonjour-dependent services.