What is the CVSS score of CVE-2026-43790?

CVE-2026-43790 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-43790?

Within 24 hours, inventory all macOS assets and identify any running versions prior to Sequoia 15.8, Golden Gate 27, or Tahoe 26.7; apply the vendor-released patch by upgrading to macOS Sequoia 15.8, Golden Gate 27, or Tahoe 26.7 where supported, prioritizing internet-facing or network-exposed systems. Within 7 days, validate patch deployment through centralized management and endpoint detection tooling, and enforce network segmentation or firewall rules to limit reachability to unidentified services on unpatched hosts. Within 30 days, confirm full fleet compliance, document any exceptions with risk acceptance and compensating controls, and monitor vendor advisories for any change in exploitation status or patch guidance.

macOS CVE-2026-43790

Q: Which versions of macOS are affected by CVE-2026-43790?

Apple macOS fleets are exposed to a critical kernel memory corruption issue that could allow a remote, network-reachable attacker to cause unexpected system termination or kernel memory corruption.. A patch is available.

EUVD-2026-78048 CRITICAL

Out-of-bounds Write (CWE-787)

2026-09-14 apple

GHSA-75g4-wpm7-g7gh

Buffer Overflow Memory Corruption Apple macOS

9.1

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed macOS component
Delivery

Send crafted malformed input
Exploit

Trigger out-of-bounds write in kernel
Execution

Corrupt kernel memory or crash system
Impact

Denial of service or memory-corruption foothold

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Per the CVSS vector, exploitation requires network reachability to a vulnerable macOS component with no authentication and no user interaction (AV:N/PR:N/UI:N), but Apple's advisory does NOT name the specific service, protocol, or content type that is remotely reachable, so the exact trigger surface is unconfirmed. The primary limiting factor is version: only macOS builds before Sequoia 15.8, Golden Gate 27, and Tahoe 26.7 are affected - patched systems are not vulnerable. Impact is confined to system crash (unexpected termination) or kernel memory corruption; there is no confidentiality impact (C:N), so this alone does not read data.
Impact	The raw CVSS 3.1 score is 9.1 (Critical) driven by a network vector with no privileges or user interaction (AV:N/AC:L/PR:N/UI:N) and high integrity/availability impact (I:H/A:H, C:N) - consistent with a CWE-787 out-of-bounds write that corrupts kernel memory or crashes the system. However, the exploitation-probability signals sharply moderate this: EPSS is only 0.29% (21st percentile), there is NO CISA KEV listing and NO public POC, so this is best characterized as 'no public exploit identified at time of analysis.' There is a tension worth flagging: Apple advisories are terse and describe the flaw only as 'improved memory handling' with a 'remote attacker' - the CVSS PR:N/UI:N/AV:N combination is asserted but the advisory gives no attack surface detail (which service, protocol, or content type is remotely reachable), so the network-unauthenticated premise cannot be independently corroborated from the input. No SSVC decision data is provided. Net: a genuinely high-severity memory-corruption bug in an ubiquitous OS with a patch already available, but the absence of exploitation evidence means it is a patch-promptly priority rather than an emergency drop-everything item. Prioritize based on macOS fleet exposure.
Exploit ScenarioDerived	A remote attacker sends crafted data to a network-reachable macOS component that mishandles memory, triggering an out-of-bounds write in kernel memory. This can immediately crash the system (denial of service) and, with a reliable primitive, corrupt kernel structures as a foothold toward privilege escalation. No public exploit code is currently known, and per the CVSS vector no authentication or user interaction is required.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 16, 2026

Kernel memory corruption in Apple macOS before Sequoia 15.8, Golden Gate 27, and Tahoe 26.7 can be triggered by a remote attacker, leading to unexpected system termination or kernel memory corruption. Exploitation requires network reachability to an unidentified service with no authentication or user interaction, though the assessed attack complexity is high (AC:H) and the exact trigger surface is unconfirmed. Apple has released patched versions, and no public exploit code has been identified; EPSS is low at 0.29%.

RemediationAI

Vendor-released patches are available: upgrade to macOS Sequoia 15.8, macOS Golden Gate 27, or macOS Tahoe 26.7. Apple's advisories are at https://support.apple.com/en-us/149035, https://support.apple.com/en-us/149042, and https://support.apple.com/en-us/149043. No workarounds are documented because the vulnerable component is not named; as a general precaution, limit network exposure of unpatched macOS systems to untrusted networks, though the effectiveness of this measure is unknown given the unconfirmed attack surface. Patch status: Vendor-released patch: macOS Sequoia 15.8, Golden Gate 27, Tahoe 26.7.

Affected VersionsENISA

macOS 0 <26.7

macOS 0 <27

macOS 0 <15.8

Affected Packages

euvd macos fix: 15.8, 26.7, 27

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is an out-of-bounds write (CWE-787) in a macOS kernel component, which Apple addressed with improved memory handling. The CVSS vector indicates a remote, unauthenticated attacker with no user interaction can trigger the issue, but the assessed attack complexity is high (AC:H), and Apple's advisory does not name the specific remotely reachable service, protocol, or content type. Impact is confined to integrity and availability (I:H/A:H) with no confidentiality impact (C:N), meaning the flaw can corrupt kernel memory or cause a system crash but does not directly disclose data. The CPE string cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:* confirms macOS as the affected platform, and the flaw is fixed in macOS Sequoia 15.8, Golden Gate 27, and Tahoe 26.7.

Know when macOS gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI 7.4 HIGH

Follows Apple's remote-unauthenticated premise (AV:N/PR:N/UI:N) and kernel-corruption/crash impact (C:N/I:H/A:H), but AC:H reflects that reliable kernel memory-corruption exploitation is typically non-trivial.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Sep 16, 2026 - 21:23 NVD

9.1 (CRITICAL)

Patch available

Sep 14, 2026 - 22:19 EUVD

CVE Published

Sep 14, 2026 - 20:49 nvd

CRITICAL 9.1

CVE Published

Sep 14, 2026 - 20:49 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.

Executive ViewAI

Why It Matters

Apple macOS fleets are exposed to a critical kernel memory corruption issue that could allow a remote, network-reachable attacker to cause unexpected system termination or kernel memory corruption. No public exploit identified at time of analysis, but the severity and potential for availability disruption make this a priority for security leadership. Vendor-released patches are available for macOS Sequoia 15.8, Golden Gate 27, and Tahoe 26.7.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Prevalence

Ubiquitous

macOS is a mainstream desktop OS deployed across countless enterprise and consumer endpoints

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.