Apple Updates Everything, (Mon, Sep 14th)
Apple patched a record 261 vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS 27, and other platforms, with none flagged as exploited.
58
CVE-2026-43702
Video-Processing Memory Corruption in Apple iOS, iPadOS, macOS, tvOS, watchOS
- CVSS 3.1
- 7.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-43702 is a memory-handling flaw in Apple's operating systems that is triggered when a device processes a maliciously crafted video file. Successful exploitation can cause unexpected app termination (denial of service) or corruption of process memory, which in Apple's own disclosure language creates a memory-corruption condition in the media-handling path. The flaw affects iPhones, iPads, Macs (both macOS Sequoia and Tahoe), Apple TV, and Apple Watch, and was addressed with improved memory handling in Apple's September updates. There is no CVSS score yet, no public proof-of-concept, and no indication of in-the-wild exploitation. Users are exposed primarily through playing or previewing video files received from untrusted sources, such as messaging attachments or downloads.
What to do: Patch all Apple devices to the fixed releases: iOS/iPadOS 26.6 or 26.7, macOS Sequoia 15.8 or macOS Tahoe 26.6/26.7, tvOS 26.6, and watchOS 26.6, prioritizing via MDM in managed fleets. Instruct users to avoid opening or previewing video files from untrusted sources. Treat reports of apps crashing or behaving erratically during video playback as a potential indicator and verify OS versions fleet-wide.
| Product | Affected |
|---|---|
| Apple iOS | versions prior to iOS 26.6 (fixed in iOS 26.6; also fixed in iOS 26.7) |
| Apple iPadOS | versions prior to iPadOS 26.6 (fixed in iPadOS 26.6; also fixed in iPadOS 26.7) |
| Apple macOS Sequoia | versions prior to macOS Sequoia 15.8 (fixed in 15.8) |
| Apple macOS Tahoe | versions prior to macOS Tahoe 26.6 (fixed in 26.6; also fixed in 26.7) |
| Apple tvOS | versions prior to tvOS 26.6 (fixed in 26.6) |
| Apple watchOS | versions prior to watchOS 26.6 (fixed in 26.6) |
Estimated exposure
massplausibly hundreds of millions of devices (Apple's installed base exceeds 1.5 billion active devices, most not yet on the 26.6/26.7/15.8 fix releases at… — Every unpatched iPhone, iPad, Mac, Apple TV, and Apple Watch is affected, and Apple's publicly reported active-device base of over 1.5 billion implies the pre-update install base is in the hundreds of millions.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory.
- Vendors
- apple
- Products
- ipados, iphone os, macos, tvos, watchos
- Weakness
- CWE-119
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H