--- id: "CVE-2026-43780" page: "https://infrastack.ai/live/CVE-2026-43780" kind: "vulnerability" aliases: ["CVE-2026-43780"] title: "An integer overflow was addressed with improved input validation" severity: "high" cvss: 7.8 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "apple ipados", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple iphone os", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["14.8.8"], "affected": ">= 14.0, < 14.8.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["15.7.8"], "affected": ">= 15.0, < 15.7.8", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["26.6"], "affected": ">= 26.0, < 26.6", "ecosystem": "vendor"}, {"name": "apple tvos", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple visionos", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}, {"name": "apple watchos", "fixed": ["26.6"], "affected": "< 26.6", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["apple", "ios", "ipad", "ipados", "iphone", "vendor", "vendor-advisory"] not_affected_if: ["already-on-26.6"] published_at: "2026-07-27T21:17:02+00:00" first_seen_at: "2026-11-13T20:39:10+00:00" updated_at: "2026-11-13T21:27:25+00:00" sources: [{"source": "lab", "url": "https://support.apple.com/en-us/128066", "first_seen_at": "2026-11-13T20:39:10+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128067", "first_seen_at": "2026-11-13T20:39:15+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128071", "first_seen_at": "2026-11-13T20:39:19+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128072", "first_seen_at": "2026-11-13T20:39:20+00:00"}, {"source": "lab", "url": "https://support.apple.com/en-us/128069", "first_seen_at": "2026-11-13T20:39:21+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43780", "first_seen_at": "2026-11-13T21:27:25+00:00"}] exploit_sources: [] --- # An integer overflow was addressed with improved input validation Link for people: https://infrastack.ai/live/CVE-2026-43780 (this .md is for agents) This is Apple's security notice for iOS 26.6 and iPadOS 26.6, listing many fixes across system components. The excerpt provided does not show what CVE-2026-43780 itself is or what it allows. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:apple ipados affected < 26.6 fixed 26.6 - vendor:apple iphone os affected < 26.6 fixed 26.6 - vendor:apple macos affected >= 14.0, < 14.8.8 fixed 14.8.8 - vendor:apple macos affected >= 15.0, < 15.7.8 fixed 15.7.8 - vendor:apple macos affected >= 26.0, < 26.6 fixed 26.6 - vendor:apple tvos affected < 26.6 fixed 26.6 - vendor:apple visionos affected < 26.6 fixed 26.6 - vendor:apple watchos affected < 26.6 fixed 26.6 ## How to check - Check the iPhone or iPad version in Settings > General > About; compare against `26.6` - Confirm the entry for CVE-2026-43780 on the Apple security content page (https://support.apple.com/en-us/128066) ## Fix - iOS and iPadOS: update to `26.6` or later, per Apple's notice - Other Apple platforms: see the linked macOS, tvOS and Apple notices for their fixed versions ## Timeline - 2026-11-13T20:39:10+00:00 lab https://support.apple.com/en-us/128066 — Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support - 2026-11-13T20:39:15+00:00 lab https://support.apple.com/en-us/128067 — Apple: About the security content of macOS Tahoe 26.6 - Apple Support - 2026-11-13T20:39:19+00:00 lab https://support.apple.com/en-us/128071 — Apple: About the security content of macOS Sequoia 15.7.8 - Apple Support - 2026-11-13T20:39:20+00:00 lab https://support.apple.com/en-us/128072 — Apple: About the security content of macOS Sonoma 14.8.8 - Apple Support - 2026-11-13T20:39:21+00:00 lab https://support.apple.com/en-us/128069 — Apple: About the security content of tvOS 26.6 - Apple Support - 2026-11-13T21:27:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-43780 ## Documents - [advisory] macOS Sonoma 14.8.8 security content https://support.apple.com/en-us/128072 - [advisory] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/128068 - [advisory] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 - [advisory] Vendor advisory: support.apple.com https://support.apple.com/en-us/128070 - [advisory] macOS Sequoia 15.7.8 security content https://support.apple.com/en-us/128071 - [advisory] Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support https://support.apple.com/en-us/128066 - [mentions] macOS Sequoia 15.7.8 security content https://support.apple.com/en-us/128071 - [mentions] macOS Sonoma 14.8.8 security content https://support.apple.com/en-us/128072 - [mentions] Apple: About the security content of tvOS 26.6 - Apple Support https://support.apple.com/en-us/128069 - [mentions] macOS Tahoe 26.6 security content https://support.apple.com/en-us/128067 - [mentions] Apple: About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support https://support.apple.com/en-us/128066 ## From the sources About the security content of iOS 26.6 and iPadOS 26.6 - Apple Support # About the security content of iOS 26.6 and iPadOS 26.6 This document describes the security content of iOS 26.6 and iPadOS 26.6. ## About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page. Apple security documents reference vulnerabilities by CVE-ID when possible. For more information about security, see the Apple Product Security page. ## iOS 26.6 and iPadOS 26.6 Released July 27, 2026 ### Accessibility Available for: iPhone 11 and later Impact: An attacker with physical access may be able to access sensitive user data during iPhone Mirroring Description: This issue was addressed through improved state management. CVE-2026-64732: Jorge Welch (@jorgwelch) ### Accounts Framework Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: This issue was addressed with improved data protection. CVE-2026-64733: Rosyna Keller of Totally Not Malicious Software (paradisefacade.com) ### App Store Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: This issue was addressed with improved checks. CVE-2026-43801: Rahul Raj ### Apple Account Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to access sensitive user data Description: An authorization issue was addressed with improved state management. CVE-2026-65353: 章鱼哥@aipyaipy.com, Chris Bailey - Short Circuit, N.M.Praveen Nawarathne (@zblockrat), Stuart Wallace Entry added September 14, 2026 ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-28928: Dun ### Apple Neural Engine Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-43748: Vladislav Shevchenko (Positive Technologies), an anonymous researcher, tamdao, Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### AppleAVD Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. CVE-2026-65407: Franco Belman at Blackwing Intelligence Entry added September 14, 2026 ### AppleDouble Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution Description: A buffer overflow was addressed with improved bounds checking. CVE-2026-43776: Irvin Wang, Peter Malone, Nicolas Rabrenovic, Rishabh Jain (rjcyber) of cyberplanet Entry updated September 14, 2026 ### Audio Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to cause a denial-of-service Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2026-64725: Seonung Park, ALTV!ST (altvi.st/) ### AuthKit Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to fingerprint the user Description: A permissions issue was addressed with additional restrictions. CVE-2026-43730: David Strnadel ### AVEVideoEncoder Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved size validation. CVE-2026-64747: Franco Belman at Blackwing Intelligence ### BackgroundAssets Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to delete files for which it does not have permission Description: A permissions issue was addressed with improved validation. CVE-2026-64707: YingQi Shi (@Mas0nShi) of DBAppSecurity's WeBin lab ### Books Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to modify protected parts of the file system Description: A race condition was addressed with improved checks. CVE-2026-43811: Rodolphe Brunetti (@eisw0lf) of Lupus Nova ### CloudAttestation Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: A maliciously crafted app may be able to bypass code signing enforcement Description: A validation issue was addressed with improved input sanitization. CVE-2026-43813: Anton Pakhunov ### Contacts Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: An app may be able to add contacts without user authorization Description: An authorization issue was addressed with improved validation. CVE-2026-64746: Rodolphe BRUNETTI (@eisw0lf) of Lupus Nova, Daniel Febrero Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 8th generation and later, and iPad mini 5th generation and later Impact: Processing a maliciously crafted contact may leak sensitive data Description: The issue was addressed with improved checks. CVE-2026-64734: Daniel Williams ### Contacts Available for: iPhone 11 and later, iPad Pro --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_