--- id: "CVE-2026-43706" page: "https://infrastack.ai/live/CVE-2026-43706" kind: "vulnerability" aliases: ["CVE-2026-43706"] title: "A double free issue was addressed with improved memory management" severity: "medium" cvss: 6.5 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-devices", "macos", "vendor", "vendor-advisory"] not_affected_if: [] published_at: "2026-06-29T20:17:35+00:00" first_seen_at: "2026-11-13T20:39:19+00:00" updated_at: "2026-11-13T21:27:24+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128071", "first_seen_at": "2026-11-13T20:39:19+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128072", "first_seen_at": "2026-11-13T20:39:20+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128069", "first_seen_at": "2026-11-13T20:39:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43706", "first_seen_at": "2026-11-13T21:27:24+00:00"}] exploit_sources: [] --- # A double free issue was addressed with improved memory management Link for people: https://infrastack.ai/live/CVE-2026-43706 (this .md is for agents) Apple's security notes for macOS Sequoia 15.7.8 list many flaws, but the text provided never mentions CVE-2026-43706. What an attacker could do through this specific flaw is unknown from these sources. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.5.2 fixed 26.5.2 - vendor:apple iphone os affected < 26.5.2 fixed 26.5.2 - vendor:apple macos affected < 26.5.2 fixed 26.5.2 ## Timeline - 2026-11-13T20:39:19+00:00 lab https://support.apple.com/en-us/128071 — Apple: About the security content of macOS Sequoia 15.7.8 - Apple Support - 2026-11-13T20:39:20+00:00 lab https://support.apple.com/en-us/128072 — Apple: About the security content of macOS Sonoma 14.8.8 - Apple Support - 2026-11-13T20:39:21+00:00 lab https://support.apple.com/en-us/128069 — Apple: About the security content of tvOS 26.6 - Apple Support - 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-43706 ## Documents - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/127594 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/127595 - [mentions] macOS Sequoia 15.7.8 security content https://support.apple.com/en-us/128071 - [mentions] macOS Sonoma 14.8.8 security content https://support.apple.com/en-us/128072 - [mentions] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 ## From the sources About the security content of macOS Sequoia 15.7.8 - Apple Support # About the security content of macOS Sequoia 15.7.8 This document describes the security content of macOS Sequoia 15.7.8. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## macOS Sequoia 15.7.8 Released July 27, 2026 ### Accounts Available for: macOS Sequoia Impact: An app may be able to gain root privileges Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-43749: Adam Franke, Trung Nguyen (@everping) of CyStack, Ashish Kunwar ### Accounts Available for: macOS Sequoia Impact: A malicious application may be able to bypass Privacy preferences Description: An authorization issue was addressed with improved state management. CVE-2026-65404: 이재영, Vinay Kumar Rasala (Xplo8E) from Appknox, Stuart Wallace, Arni Hardarson (Neonix Security) Entry added September 14, 2026 ### afpfs Available for: macOS Sequoia Impact: A remote attacker may be able to cause unexpected system termination or corrupt kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-64767: Dave G. ### afpfs Available for: macOS Sequoia Impact: Connecting to a malicious afpfs server may lead to kernel memory corruption Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43815: Dave G. Entry added September 14, 2026 ### apache Impact: A remote attacker may be able to cause a denial-of-service Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. CVE-2026-23918: Bartlomiej Dmitruk of striga.ai, Stanislaw Strzalkowski of isec.pl Entry updated September 14, 2026 ### APFS Impact: A remote user may be able to cause unexpected system termination or corrupt kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64695: Narendra Singh (@_3P1C), Peter Malone Entry updated September 14, 2026 ### App Store Impact: An app may be able to access sensitive user data CVE-2026-43801: Rahul Raj ### Apple Account Description: A race condition was addressed with improved state handling. CVE-2026-43781: Pinak Oza ### Apple Account Impact: A malicious app may be able to break out of its sandbox Description: An authorization issue was addressed with improved state management. CVE-2026-64737: Robert Mindo ### Apple Neural Engine Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence Entry updated September 14, 2026 ### AppleDouble Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Peter Malone, Nicolas Rabrenovic, Irvin Wang, Rishabh Jain (rjcyber) of cyberplanet Entry updated September 14, 2026 ### AppleRAID Impact: A local user may be able to read kernel memory Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43681: impost0r (ret2plt), David Ige - Beryllium Security ### AppleRAID Impact: Mounting a malicious disk image may cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43761: lokerxx, Narendra Singh (@_3P1C), Lyutoon, Jordy Zomer (@pwningsystems), Richard Zana, George Stergiopoulos, InfoSec lab, Athens University of Economics and Business, Greece, Aswin Kumar Gokulakannan Entry added September 14, 2026 ### Assets Impact: A malicious application may be able to bypass Privacy preferences CVE-2026-43672: 이재영 ### ATS Impact: An app may be able to read files outside of its sandbox Description: A permissions issue was addressed by removing the vulnerable code. CVE-2026-43763: Pavan Nallamothu, Jared Reyes ### Audio Impact: An app may be able to break out of its sandbox CVE-2026-64702: John Lussier ### Audio Impact: An app may be able to cause a denial-of-service CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AVEVideoEncoder Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### AVEVideoEncoder Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64762: Franco Belman at Blackwing Intelligence, Dun ### BackgroundAssets Impact: An app may be able to delete files for which it does not have permission CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab ### BOM Impact: A maliciously crafted ZIP archive may bypass Gatekeeper checks CVE-2026-28849: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ### cd9660 Impact: An app may be able to cause unexpected system termination or read kernel memory CVE-2026-64698: Richard Zana, Peter Malone, Nathaniel Oh (@calysteon), an anonymous researcher ### Contacts Impact: Processing a maliciously crafted contact may leak sensitive data CVE-2026-64734: Daniel Williams ### Control Center CVE-2026-43756: 이재영 ### Core Services Impact: An app may be able to gain root privileges Description: A race condition was addressed with improved state handling. CVE-2026-43693: Gergely Kalman (@gergely_kalman) ### CoreAudio CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative ### CoreAudio Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher Entry updated September 14, 2026 ### CoreAudio Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj ### CoreMedia CVE-2026-43775: Csaba Fitzl (@theevilbit) of Iru ### CoreMedia Impact: Processing a maliciously crafted video file may lead to unexpected app termination CVE-2026-43711: James Duffy (@0x4A616D657344) ### CoreServices Impact: Processing a maliciously crafted file may lead to unexpected app termination CVE-2026-28936: Andreas Jaegersberger & Ro Achterberg of Nosebeard Labs ### CoreUI Available for: macOS Sequoia Impact: Processing a maliciously crafted asset catalog may result in disclosure of process memory Description: The issue was addressed with improved memory handling. CVE-2026-43738: Peter Malone ### CoreUI Available for: macOS Sequoia Impact: An app may be able to cause a denial of service Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-84489: stratan (@5tratan), Peter Malone Entry added September 14, 2026 ### CoreVideo Available for: macOS Sequoia Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43802: an anonymous researcher ### Crash Reporter Available for: macOS Sequoia Impact: An app may be able to leak sensitive user information Description: A privacy issue was addressed by removing sensit --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_