--- id: "CVE-2026-43732" page: "https://infrastack.ai/live/CVE-2026-43732" kind: "vulnerability" aliases: ["CVE-2026-43732"] title: "A path handling issue was addressed with improved validation" severity: "medium" cvss: 6.5 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple safari", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}, {"name": "apple ipados", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.5.2"], "affected": "< 26.5.2", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.5.2"], "affected": ">= 26.0, < 26.5.2", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "apple-tv", "tvos", "vendor", "vendor-advisory"] not_affected_if: [] published_at: "2026-06-29T20:17:37+00:00" first_seen_at: "2026-11-13T20:39:21+00:00" updated_at: "2026-11-13T21:27:24+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128069", "first_seen_at": "2026-11-13T20:39:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43732", "first_seen_at": "2026-11-13T21:27:24+00:00"}] exploit_sources: [] --- # A path handling issue was addressed with improved validation Link for people: https://infrastack.ai/live/CVE-2026-43732 (this .md is for agents) Apple's tvOS 26.6 security notes list fixes for many flaws, including kernel memory and app sandbox issues. The text provided does not contain an entry for CVE-2026-43732, so what this specific CVE allows an attacker to do is unknown. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple safari affected < 26.5.2 fixed 26.5.2 - vendor:apple ipados affected < 26.5.2 fixed 26.5.2 - vendor:apple iphone os affected < 26.5.2 fixed 26.5.2 - vendor:apple macos affected >= 26.0, < 26.5.2 fixed 26.5.2 ## How to check - Confirm each Apple TV runs tvOS `26.6` or later. - Check the CVE-2026-43732 entry on the Apple advisory page for its component and impact: unknown from these sources. ## Fix - tvOS: `26.6`, the release Apple's advisory covers. The CVE-specific fix entry is not in the text provided. ## Timeline - 2026-11-13T20:39:21+00:00 lab https://support.apple.com/en-us/128069 — Apple: About the security content of tvOS 26.6 - Apple Support - 2026-11-13T21:27:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-43732 ## Documents - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/127594 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/127595 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/127685 - [mentions] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 ## From the sources About the security content of tvOS 26.6 - Apple Support # About the security content of tvOS 26.6 This document describes the security content of tvOS 26.6. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## tvOS 26.6 Released July 27, 2026 ### Accounts Framework Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) ### App Store Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj ### Apple Neural Engine Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun ### AppleAVD Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### Audio Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AuthKit Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel ### AVEVideoEncoder Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### CloudAttestation Available for: Apple TV HD and Apple TV 4K (all models) Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov ### CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted audio file may corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43673: Anonymous working with TrendAI Zero Day Initiative ### CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing an audio stream in a maliciously crafted media file may terminate the process Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43744: ret2happy, Mathis Mansière, an anonymous researcher Entry updated September 14, 2026 ### CoreAudio Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43803: Rahul Raj ### CoreMedia Impact: Processing a maliciously crafted video file may lead to unexpected app termination Description: A memory corruption issue was addressed with improved memory handling. CVE-2026-43711: James Duffy (@0x4A616D657344) ### CoreMedia Video Toolbox Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory Description: The issue was addressed with improved memory handling. CVE-2026-43702: Nathaniel Oh (@calysteon) Entry added September 14, 2026 ### curl Available for: Apple TV HD and Apple TV 4K (all models) Impact: Authentication credentials may be sent to a server on another origin Description: This is a vulnerability in open source code and Apple Software is among the affected projects. The CVE-ID was assigned by a third party. Learn more about the issue and CVE-ID at cve.org. ### FrontBoard Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data CVE-2026-64742: Huỳnh Tấn Ngàn ### Game Center Available for: Apple TV HD and Apple TV 4K (all models) Impact: A malicious app may be able to break out of its sandbox Description: A parsing issue in the handling of directory paths was addressed with improved path validation. CVE-2026-64740: Manuel Fernandez (Stackhopper Security) ### Game Center Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to access sensitive user data CVE-2026-43796: Ilya Andr (andrd3v) of Positive Technologies, Stanislav Jelezoglo ### Heimdal Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds read was addressed with improved bounds checking. CVE-2026-64692: Redon Gashi ### ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted texture may lead to unexpected app termination Description: An integer overflow was addressed with improved input validation. CVE-2026-43780: Michael DePlante (@izobashi) of TrendAI Zero Day Initiative ### ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may corrupt process memory CVE-2026-64716: Arni Hardarson, Jonathan Alush-Aben, Peter Malone ### ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to unexpected app termination Description: The issue was addressed with improved bounds checks. CVE-2026-64758: 진규정 (Gyujeong Jin, @G1uN4sh) ### ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted file may lead to a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64754: PETOWORKS의 Bugeun Choi (@Bugeun), Rahul Raj ### ImageIO Available for: Apple TV HD and Apple TV 4K (all models) Impact: Processing a maliciously crafted image may lead to a denial-of-service CVE-2026-64693: Geonha Lee (@leegn4a) ### IOGPUFamily Impact: An app may be able to cause unexpected system termination Description: A race condition was addressed with improved state handling. CVE-2026-43743: Lyutoon, Dun ### Kernel Impact: An app may be able to cause unexpected system termination or corrupt kernel memory Description: A use after free issue was addressed with improved memory management. CVE-2026-43778: Ashish Kunwar, f0r of MurphySec, Feng Xue and XGPT of ThreatBook, Mahmoud Abdelmoniem, an anonymous researcher, Wang Yu, Lyutoon, Hiroki Imai (LAC Co., Ltd.), DARKNAVY (@DarkNavyOrg), Fábio Luís @scanpt, Nicolas Rabrenovic Entry updated September 14, 2026 ### Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: An app may be able to disclose kernel memory Description: The issue was addressed with improved memory handling. CVE-2026-64709: Pasquale Scola, Billy Jheng Bing Jhong and Pan Zhenpeng (@Peterpan0927) of STAR Labs SG Pte. Ltd. ### Kernel Available for: Apple TV HD and Apple TV 4K (all models) Impact: A remote attacker may be able to bypass network filters Description: An inconsistent user interface issue was addressed with improved state management. CVE-2026-6473 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_