Memory Corruption from Malicious File in Apple iOS, iPadOS, and macOS Golden Gate
AI analysis
CVE-2026-43688 is a memory corruption vulnerability in Apple's operating systems caused by insufficient input validation during file processing. It is triggered when a device processes a maliciously crafted file, and Apple's advisory lists unexpected app termination (denial of service) as the observed impact, though memory corruption flaws carry inherent risk of worse outcomes depending on the underlying defect. The issue was fixed with improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27, meaning all iPhones, iPads, and Macs running earlier releases are affected. No CVSS score has been assigned yet, and there is no known public proof of concept or evidence of in-the-wild exploitation.
What to do: Update iPhones and iPads to iOS/iPadOS 27 and Macs to macOS Golden Gate 27 or later as soon as the September updates are available. Until devices are patched, advise users to avoid opening files, attachments, or downloads from untrusted or unexpected sources, since the flaw is triggered simply by processing a maliciously crafted file. Monitor for a CVSS assignment and any CISA KEV listing, which would signal elevated active-exploitation risk.
Affected
| Apple iOS | All versions prior to iOS 27 |
| Apple iPadOS | All versions prior to iPadOS 27 |
| Apple macOS Golden Gate | All versions prior to macOS Golden Gate 27 |
Estimated exposure
mass≈1 billion+ iPhone/iPad users plus 100 million+ Macs not yet on the 27 releases (order-of-magnitude estimate) — Apple reports an installed base of more than 2 billion active devices worldwide, and every iOS, iPadOS, and macOS Golden Gate device that has not yet updated to the 27 releases remains vulnerable, so exposure plausibly runs into the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. Processing a maliciously crafted file may lead to unexpected app termination.