TVOS · CVE-2026-43707 · Infrastructure
FIX → 26.5.2
This is Apple's security notice for tvOS 26.6, released July 27, 2026, and it lists many fixes for Apple TV devices. The listed flaws let an app read sensitive data, crash the system, or in some cases run code with kernel privileges, but the notice does not describe CVE-2026-43707 by name.
first public Jun 29, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Owners of Apple TV HD and Apple TV 4K devices running tvOS versions before 26.6 are the affected group named in the notice. The sources do not confirm which exposure applies to CVE-2026-43707 specifically, so the notice is the only basis for this entry.
Not affected if already-on-tvos-26.6
Who cares apple, apple-tv, tvos, vendor-advisory
tvOS 26.6 or later means the release is installed)About the security content of tvOS 26.6 - Apple Support
This document describes the security content of tvOS 26.6.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released July 27, 2026
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: This issue was addressed with improved data protection.
CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com)
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
Description: This issue was addressed with improved checks.
CVE-2026-43801: Rahul Raj
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-28928: Dun
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Upgrade to 26.5.2
tvOS 26.6 (the release that carries the listed fixes; the sources do not confirm this CVE is among them)Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause unexpected system termination
Description: A use after free issue was addressed with improved memory management.
CVE-2026-65407: Franco Belman at Blackwing Intelligence
Entry added September 14, 2026
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/)
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to fingerprint the user
Description: A permissions issue was addressed with additional restrictions.
CVE-2026-43730: David Strnadel
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to execute arbitrary code with kernel privileges
Description: A buffer overflow was addressed with improved size validation.
CVE-2026-64747: Franco Belman at Blackwing Intelligence
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A maliciously crafted app may be able to bypass code signing enforcement
Description: A validation issue was addressed with improved input sanitization.
CVE-2026-43813: Anton Pakhunov
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted audio file may corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing an audio stream in a maliciously crafted media file may terminate the process
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher
Entry updated September 14, 2026
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to cause unexpected system termination
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-43803: Rahul Raj
Impact: Processing a maliciously crafted video file may lead to unexpected app termination
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2026-43711: James Duffy (@0x4A616D657344)
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory
Description: The issue was addressed with improved memory handling.
CVE-2026-43702: Nathaniel Oh (@calysteon)
Entry added September 14, 2026
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Authentication credentials may be sent to a server on another origin
Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org.
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
CVE-2026-64742: Huỳnh Tấn Ngàn
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A malicious app may be able to break out of its sandbox
Description: A parsing issue in the handling of directory paths was addressed with improved path validation.
CVE-2026-64740: Manuel Fernandez (Stackhopper Security)
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to access sensitive user data
CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to cause a denial-of-service
Description: An out-of-bounds read was addressed with improved bounds checking.
CVE-2026-64692: Redon Gashi
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted texture may lead to unexpected app termination
Description: An integer overflow was addressed with improved input validation.
CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may corrupt process memory
CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to unexpected app termination
Description: The issue was addressed with improved bounds checks.
CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh)
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted file may lead to a denial-of-service
Description: An out-of-bounds write issue was addressed with improved bounds checking.
CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: Processing a maliciously crafted image may lead to a denial-of-service
CVE-2026-64693: Geonha Lee (@leegn4a)
Impact: An app may be able to cause unexpected system termination
Description: A race condition was addressed with improved state handling.
CVE-2026-43743: Lyutoon, Dun
Impact: An app may be able to cause unexpected system termination or corrupt kernel memory
Description: A use after free issue was addressed with improved memory management.
CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic
Entry updated September 14, 2026
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An app may be able to disclose kernel memory
Description: The issue was addressed with improved memory handling.
CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd.
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: A remote attacker may be able to bypass network filters
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2026-6473
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.