What is the CVSS score of CVE-2026-43673?

CVE-2026-43673 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple Operating Systems are affected by CVE-2026-43673?

Memory corruption in Apple's audio processing framework affects all major Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS), enabling arbitrary code execution when users process malicious…. A patch is available.

How to fix or mitigate CVE-2026-43673?

Within 24 hours, inventory all Apple devices across the organization and identify systems and users that regularly process audio files from external sources. Within 7 days, deploy Apple's security updates for the audio processing framework to iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS across business-critical and user-facing systems, consulting Apple's official security advisories for exact patch versions specific to each platform. Complete full patch deployment across the entire installed base within 30 days. Until patching is complete, restrict the processing of audio files sourced from untrusted external origins.

Apple Operating Systems CVE-2026-43673

EUVD-2026-49452 HIGH

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-2gqg-xm37-vrf5

Buffer Overflow Apple Ios And Ipados Tvos Visionos Watchos

7.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be locally processed (AV:L) with victim interaction (UI:R) and no privileges (PR:N); memory corruption plausibly yields full C/I/A impact within the unchanged process scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:23 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

7.8 (HIGH)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

HIGH 7.8

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted audio file may corrupt process memory.

AnalysisAI

Memory corruption in Apple's audio processing framework affects iOS, iPadOS, macOS (Sonoma, Sequoia, Tahoe), tvOS, visionOS, and watchOS, where parsing a maliciously crafted audio file can corrupt process memory and potentially lead to arbitrary code execution. The flaw requires a victim to open or process the malicious file (local vector, user interaction) but no prior privileges. Apple has shipped fixes across all platforms; no public exploit identified at time of analysis and EPSS is low (0.16%).

Technical ContextAI

The vulnerability lies in Apple's media/audio decoding path (the frameworks responsible for parsing audio container and codec data, e.g. CoreAudio/AudioToolbox), which are shared across all of Apple's operating systems. CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) is the root-cause class, and the vendor tag 'Buffer Overflow' indicates that malformed length or offset fields in the audio file drive reads/writes outside the intended buffer bounds. Apple states the issue was resolved through 'improved memory handling,' consistent with added bounds validation in the parser. The affected CPEs span apple:ios_and_ipados, apple:macos, apple:tvos, apple:visionos, and apple:watchos, confirming this is a cross-platform defect in common Apple media code rather than a single product.

RemediationAI

Vendor-released patch: update to iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6, per Apple's advisories at https://support.apple.com/en-us/128066 through https://support.apple.com/en-us/128072. There is no vendor-documented configuration workaround; until devices are updated, the practical compensating control is to avoid opening audio files from untrusted sources and to block or quarantine inbound audio attachments at mail/web gateways (trade-off: may disrupt legitimate media workflows). Enterprise fleets should push the updates via MDM and prioritize internet-facing and high-value user devices first.