CVE-2026-43697

CVE-2026-43697 is an out-of-bounds read in Apple macOS that is triggered when the operating system processes a maliciously crafted 3D file, fixed with improved bounds checking. Successful exploitation would most plausibly cause an application crash or expose a limited amount of process memory (information disclosure), since out-of-bounds reads typically do not permit code execution by themselves. All Mac users running macOS Sequoia prior to 15.8, macOS Tahoe prior to 26.7, and macOS Golden Gate prior to 27 are affected. Apple patched the flaw in its September 'Updates Everything' release wave, and the issue carries no CVSS score yet. There is no evidence of in-the-wild exploitation and no public proof of concept at this time.

What to do: Update to macOS Sequoia 15.8, macOS Tahoe 26.7, or macOS Golden Gate 27 via System Settings > General > Software Update as soon as possible. Until patched, users should avoid opening 3D files (e.g., models from untrusted email attachments, downloads, or shared links) in any application that previews or imports 3D content. IT teams should verify fleet-wide patch levels for these three fixed macOS versions.