CVE-2026-43750
published 2026-07-27CVE-2026-43750: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may…
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.77%
55.0th percentile
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos | < 14.8.8 | 14.8.8 |
| apple | macos | < 15.7.8 | 15.7.8 |
| apple | macos | < 26.6 | 26.6 |
| apple | macos | >= 14.0 < 14.8.8 | 14.8.8 |
| apple | macos | >= 15.0 < 15.7.8 | 15.7.8 |
| apple | macos | >= 26.0 < 26.6 | 26.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apple macOS up to 14.8.7/15.7.7/26.5 buffer overflow (EUVD-2026-49547)
vuldb·2026-07-29·CVSS 9.8
CVE-2026-43750 [CRITICAL] Apple macOS up to 14.8.7/15.7.7/26.5 buffer overflow (EUVD-2026-49547)
A vulnerability classified as critical has been found in Apple macOS up to 14.8.7/15.7.7/26.5. This affects an unknown function. Performing a manipulation results in buffer overflow.
This vulnerability is known as CVE-2026-43750. Attacking locally is a requirement. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
A buffer overflow was addressed with improved bounds checking.
ghsa_unreviewed·2026-07-27
CVE-2026-43750 [CRITICAL] CWE-120 A buffer overflow was addressed with improved bounds checking.
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges.
No detection rules found.
No public exploits indexed.
2026-07-27
Published