What is the CVSS score of CVE-2026-43682?

CVE-2026-43682 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apple macOS are affected by CVE-2026-43682?

A critical memory-handling flaw in Apple's macOS kernel affects Mac endpoints running macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8, where a remote attacker could trigger…. A patch is available.

How to fix or mitigate CVE-2026-43682?

Within 24 hours, inventory all macOS endpoints and identify any running Tahoe versions below 26.6, Sonoma versions below 14.8.8, or Sequoia versions below 15.7.8, and prioritize update deployment for internet-facing or remote-access-enabled Macs and any Macs used for privileged or executive functions; deploy the vendor-released patch for macOS Sequoia 15.7.8, Sonoma 14.8.8, or Tahoe 26.6, and warn users not to postpone the update prompt. Within 7 days, complete patch rollout across at least 90% of the fleet using your MDM or software-update management tooling, verify installation by confirming build versions in device compliance reporting, and isolate or restrict any devices that cannot be updated. Within 30 days, achieve full fleet compliance on the remediated builds, validate that no endpoints remain on vulnerable versions, and document the exception process for any legacy hardware that cannot be upgraded so those devices are tracked and monitored as accepted risk.

Apple macOS CVE-2026-43682

EUVD-2026-49524 CRITICAL

Buffer Overflow (CWE-119)

2026-07-27 apple

GHSA-wmj5-pr45-6gg2

Buffer Overflow Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.8 MEDIUM

Apple's 'remote user' implies an authenticated network user (PR:L); kernel memory-corruption races are typically hard to win (AC:H); described impact is kernel corruption and panic (I:H/A:H) with no stated disclosure (C:N).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 22:30 vuln.today

CVSS changed

Jul 28, 2026 - 20:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:13 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 27, 2026 - 20:13 cve.org

CRITICAL 9.8

DescriptionCVE.org

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

AnalysisAI

Kernel memory-handling faults in Apple macOS can let a remote attacker cause unexpected system termination or corrupt kernel memory on unpatched systems - macOS Tahoe before 26.6, Sonoma before 14.8.8, and Sequoia before 15.7.8. Apple addressed the flaw with improved memory handling in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, so fully updated builds are remediated; there is no public exploit identified at time of analysis and no confirmed active exploitation, and the EPSS score remains low at 0.24% (15th percentile). Apple's own wording that 'a remote user' may trigger the issue, combined with the published CVSS vector (PR:N) versus our assessed vector (PR:L, AC:H), leaves the authentication prerequisite ambiguous, but the realistically demonstrated outcome is denial of service via kernel panic, with memory-corruption-driven code execution or data disclosure possible in principle but unconfirmed.

Technical ContextAI

The vulnerability is a CWE-119 improper-restriction-of-operations-within-the-bounds-of-a-memory-buffer issue in Apple's XNU kernel, the core of macOS that mediates memory allocation, IPC, and driver/network-facing system calls. Apple's terse advisory language ('the issue was addressed with improved memory handling') is characteristic of kernel memory-corruption fixes where a crafted input reaches an allocation or copy path that mishandles length or bounds, corrupting adjacent kernel memory. The CPE string cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* indicates the flaw is tracked against the macOS platform itself rather than a discrete user-space component, meaning exploitation depends on delivering crafted data to a reachable kernel path. Our assessment rates the attack as network-reachable (AV:N) but with high attack complexity (AC:H) and low privileges (PR:L), no user interaction (UI:N), and total technical impact per SSVC (C:N/I:H/A:H in our vector) - the loss of integrity and availability reflects kernel memory corruption and panic, while confidentiality impact of the published 9.8 score is not corroborated by our analysis. CWE-119 is a high-yield class in kernel code because corrupted internal structures can escalate from a crash into control-flow hijack if an attacker can shape the corrupted memory reliably; that escalation is not confirmed here, which is why the assessed score is lower than the vendor-published 9.8.

RemediationAI

Apply the vendor-released patch by upgrading to macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6 as appropriate for the installed release train, using the Apple advisories at https://support.apple.com/en-us/128067, https://support.apple.com/en-us/128071, and https://support.apple.com/en-us/128072 to confirm which build applies to each host. Because the flaw is in the kernel and the fixed releases are cumulative OS updates, there is no narrower component-level workaround: the practical alternatives are time-bounded compensating controls. Restrict network reachability to the affected host so only trusted networks or VPN peers can send traffic to it (reduces exposure but does not protect against an attacker already inside the trusted segment, and may break remote-access workflows), and reduce the exposed service surface by disabling or firewalling non-essential listening daemons in the interim. Fleet-level enforcement via MDM is the most reliable way to guarantee compliance, and because exploitation is neither confirmed in KEV nor supported by public exploit code, prioritization can follow normal patching cadence - though the SSVC 'automatable: yes' and 'total' technical-impact ratings argue for treating unpatched, network-exposed macOS hosts as high priority.