External risk intelligence

macOS Disk Image Parsing Out-of-Bounds Read Leading to Kernel Memory Corruption.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-43773

The vulnerability requires a user to mount a maliciously crafted disk image locally on the system. This action is a client-side, user-initiated process that is not inherently exposed to the public internet or reachable via remote network protocols in common deployment patterns.

Out-of-bounds Read

Apple Macos

14.0 to before 14.8.815.0 to before 15.7.826.0 to before 26.6

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in macOS, potentially leading to system instability or kernel memory corruption. This issue arises from the handling of specially crafted disk images, which could be exploited if users interact with malicious files. The primary concern is to confirm if any systems are running the affected software and thus exposed to this risk.

Malicious disk images can crash macOS systems.
Confirms exposure and technical relevance to leadership.
Assess system impact and user interaction risks.

Attack Path

How an attacker could exploit the issue

An attacker could entice a user to mount a specially crafted disk image. This action involves the system's disk image handling, which can then lead to unexpected termination or kernel memory corruption due to an out-of-bounds read.

No privileges or user interaction needed.
Mounting a malicious disk image.
System termination or kernel memory corruption.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, mounting a maliciously crafted disk image could lead to unexpected system termination or corrupt kernel memory.

Kernel memory integrity.
Mounting a crafted disk image.
Unexpected system termination.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects macOS systems and requires user interaction to exploit by mounting a crafted disk image. The primary responsibility for remediation likely falls to system owners and infrastructure teams responsible for managing macOS endpoints. The first step is to identify all macOS systems within the environment, confirm their operating system versions, and assess exposure, prioritizing critical systems.

System owners are responsible for remediation.
Verify affected macOS versions and reachability.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is macOS Sequoia, Sonoma, and Tahoe?

These are versions of the macOS operating system. They act as the core software managing your computer's hardware and files. Disk images, often seen as .dmg files, are virtual storage containers that the system mounts to let you access the data inside them as if you had plugged in an external drive.

What does CVE-2026-43773 mean by out-of-bounds read?

This vulnerability, classified as CWE-125, happens when the software tries to read data past the end of a designated memory buffer. In CVE-2026-43773, the macOS disk image parser fails to verify the size of data properly. This error can cause the system to crash unexpectedly or, more severely, allow a malicious file to read or corrupt sensitive kernel memory.

How is this macOS disk image bug triggered?

An attacker must trick a user into mounting a specifically prepared, malicious disk image file on their machine. Simply having the file on your computer is not enough to trigger the vulnerability. The issue only occurs during the process of opening or mounting the disk image, which activates the flawed parsing logic within the operating system.

Do I need to worry about this vulnerability?

According to Halo Surface Signal, this threat is considered very unlikely for most systems. It requires physical or local user interaction, meaning the vulnerability is not exposed to the public internet. If your systems are managed internally and users are trained to avoid opening untrusted files, the practical risk of remote exploitation remains low.

What should I do if I use macOS?

The most effective response is to update your operating system to the versions specified by Apple, which include fixes for this memory handling error. Start by auditing your environment to locate all macOS endpoints and verify their current version numbers. Prioritize updates on devices that frequently handle external files or shared media, ensuring they move to the patched versions as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.