CVE-2026-43683

CVE-2026-43683 is an out-of-bounds read in Apple's macOS that was fixed with improved bounds checking. A malicious or compromised app running on an affected Mac can trigger the flaw to cause unexpected process termination (a crash) or to disclose process memory, potentially exposing sensitive data held in that process such as tokens or other secrets. The flaw affects macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27, with fixes shipping in Apple's broad September 14 'Updates Everything' release wave. No CVSS score has been assigned yet, no public proof of concept exists, and there is no evidence of exploitation in the wild.

What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 (or later) via System Settings > General > Software Update. Since exploitation requires a malicious app on the Mac, enforce Gatekeeper/notarization policies and restrict software installs to trusted sources. On managed fleets, audit recently added third-party apps and confirm patch compliance against Apple's September security advisory.