Apple Updates Everything, (Mon, Sep 14th)
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
58
CVE-2026-43697
Out-of-Bounds Read When Processing Malicious 3D Files in Apple macOS
- CVSS 3.1
- 7.1 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-43697 is an out-of-bounds read in Apple macOS that is triggered when the operating system processes a maliciously crafted 3D file, fixed with improved bounds checking. Successful exploitation would most plausibly cause an application crash or expose a limited amount of process memory (information disclosure), since out-of-bounds reads typically do not permit code execution by themselves. All Mac users running macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27 are affected. Apple patched the flaw in its September 'Updates Everything' release wave, and the issue carries no CVSS score yet. There is no evidence of in-the-wild exploitation and no public proof of concept at this time.
What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 via System Settings > General > Software Update as soon as possible. Until patched, users should avoid opening 3D files (e.g., models from untrusted email attachments, downloads, or shared links) in any application that previews or imports 3D content. IT teams should verify fleet-wide patch levels for these three fixed macOS versions.
| Product | Affected |
|---|---|
| Apple macOS Sequoia | before 15.8 (fixed in 15.8) |
| Apple macOS Tahoe | before 26.7 (fixed in 26.7) |
| Apple macOS Golden Gate | before 27 (fixed in 27) |
Estimated exposure
mass≈100M+ devices (Apple's active Mac install base, concentrated on recent macOS versions) — Apple's active Mac installed base is commonly estimated in the hundreds of millions, and Sequoia and Tahoe are recent shipping macOS versions, so a large share of Macs were plausibly unpatched at disclosure, shrinking as users adopt the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted 3D file may lead to an out-of-bounds read.