ZeroHour

CVE-2026-43688

mass

Memory Corruption from Malicious File in Apple iOS, iPadOS, and macOS Golden Gate

CVSS
EPSS
Published
()
Modified
AI analysis

CVE-2026-43688 is a memory corruption vulnerability in Apple's operating systems caused by insufficient input validation during file processing. It is triggered when a device processes a maliciously crafted file, and Apple's advisory lists unexpected app termination (denial of service) as the observed impact, though memory corruption flaws carry inherent risk of worse outcomes depending on the underlying defect. The issue was fixed with improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27, meaning all iPhones, iPads, and Macs running earlier releases are affected. No CVSS score has been assigned yet, and there is no known public proof of concept or evidence of in-the-wild exploitation.

What to do: Update iPhones and iPads to iOS/iPadOS 27 and Macs to macOS Golden Gate 27 or later as soon as the September updates are available. Until devices are patched, advise users to avoid opening files, attachments, or downloads from untrusted or unexpected sources, since the flaw is triggered simply by processing a maliciously crafted file. Monitor for a CVSS assignment and any CISA KEV listing, which would signal elevated active-exploitation risk.

Affected
Apple iOSAll versions prior to iOS 27
Apple iPadOSAll versions prior to iPadOS 27
Apple macOS Golden GateAll versions prior to macOS Golden Gate 27
Estimated exposure
mass≈1 billion+ iPhone/iPad users plus 100 million+ Macs not yet on the 27 releases (order-of-magnitude estimate) — Apple reports an installed base of more than 2 billion active devices worldwide, and every iOS, iPadOS, and macOS Golden Gate device that has not yet updated to the 27 releases remains vulnerable, so exposure plausibly runs into the…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.

In the news

Apple Updates Everything, (Mon, Sep 14th)

Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.

Apple's annual OS update shipped iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27, and visionOS 27 plus bug-fix releases for the 26 and 15 branches, fixing a record 261 vulnerabilities. Notable issues include multiple kernel flaws allowing root privilege escalation (CVE-2026-43689, CVE-2026-43691, CVE-2026-43698, CVE-2026-43786), remote code execution in CUPS (CVE-2026-43692), kernel memory corruption via malicious NFS servers (CVE-2026-43686, CVE-2026-43687), and WebKit memory corruption from crafted web content (CVE-2026-43715). No vulnerabilities are labeled as actively exploited, and Apple does not assign per-CVE severities. Users report iOS 26.7 being downloaded when iOS 27 is intended, and tools like Little Snitch and BlockBlock need updates before upgrading to macOS 27.