What is the CVSS score of CVE-2026-43756?

CVE-2026-43756 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-43756?

Yes, a patch is available for CVE-2026-43756. Update the affected software to the latest version immediately.

macOS CVE-2026-43756

EUVD-2026-49433 MEDIUM

Information Exposure (CWE-200)

2026-07-27 apple

GHSA-gfmx-gfcv-fq6c

Information Disclosure Apple

5.5

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack, low complexity, no privileges, user interaction required, high confidentiality impact only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:36 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

5.5 (MEDIUM)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:14 cve.org

MEDIUM 5.5

CVE Published

Jul 27, 2026 - 20:14 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.

AnalysisAI

Information disclosure in macOS allows a malicious app to access user-sensitive data when the user is tricked into running it. Affected versions include macOS Sequoia before 15.7.8, Sonoma before 14.8.8, and Tahoe before 26.6. No active exploitation has been confirmed, and the EPSS score is low (0.15%), indicating minimal real-world risk at this time.

Technical ContextAI

The vulnerability is a logic issue categorized under CWE-200 (Exposure of Sensitive Information), likely stemming from improper validation of access controls within macOS. The affected products as per CPE are all versions of macOS prior to the fixed releases. The root cause involves a failure to adequately restrict an app's ability to access user-sensitive data through normal system interfaces, potentially allowing bypass of privacy protections.

RemediationAI

The primary fix is to update macOS to the latest patched versions: macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, or macOS Tahoe 26.6, available from Apple via System Update or the provided advisory links. No workarounds are documented; users should avoid running untrusted applications and enable Gatekeeper protections to reduce risk until the patch is applied.