What is the CVSS score of CVE-2026-43764?

CVE-2026-43764 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-43764?

Yes, a patch is available for CVE-2026-43764. Update the affected software to the latest version immediately.

macOS CVE-2026-43764

EUVD-2026-49495 CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-27 apple

GHSA-7x4v-q6x6-2vpc

Buffer Overflow Integer Overflow Apple

9.8

CVSS 3.1 · Vendor: apple

Severity by source

Vendor (apple) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.5 MEDIUM

Local attack vector and user interaction required; impact restricted to availability (system crash) per description.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (apple).

CVSS VectorVendor: apple

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 28, 2026 - 16:23 vuln.today

CVSS changed

Jul 28, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Jul 27, 2026 - 21:17 EUVD

CVE Published

Jul 27, 2026 - 20:12 cve.org

CRITICAL 9.8

CVE Published

Jul 27, 2026 - 20:12 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

AnalysisAI

An integer overflow vulnerability in macOS can be triggered by a malicious app to cause unexpected system termination, effectively a denial-of-service. The flaw affects macOS versions prior to Sonoma 14.8.8, Sequoia 15.7.8, and Tahoe 26.6. Although the public CVSS score suggests critical remote code execution, the actual impact appears limited to system crashes, and there is no evidence of active exploitation or public proof-of-concept code.

Technical ContextAI

The vulnerability (CWE-190 Integer Overflow) exists in a macOS component that processes input from an application. CPE data indicates all macOS versions prior to the fixed releases are affected. Apple's advisory states that improved input validation addresses the overflow, hinting at a missing bounds check on a size calculation. The exact underly system service is not disclosed, but typically such overflows in kernel-space or system-level services can lead to memory corruption and panic.

RemediationAI

Upgrade macOS to the fixed version matching your release: Sonoma 14.8.8, Sequoia 15.7.8, or Tahoe 26.6. No official workarounds are provided; exercise caution with untrusted applications and consider application allowlisting to reduce the attack surface.