External risk intelligence

macOS Kernel Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-43790

This vulnerability affects the macOS operating system kernel. While it is network-reachable in theory, the kernel is not an internet-facing service, application, or edge gateway. It is a local component of the endpoint operating system, making direct exposure to the public internet highly unlikely in typical deployment patterns.

Out-of-bounds Write

Apple Macos

15.0 to before 15.826.0 to before 26.7

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability in macOS could allow attackers to remotely cause unexpected system shutdowns or corrupt essential kernel memory. While the underlying technology is a core part of the operating system, its direct exposure to external networks is unlikely in standard configurations. The main concern is confirming its relevance and whether any specific exposure exists within our environment.

An unknown flaw can crash or corrupt macOS systems.
It impacts core operating system functions.
Confirm if this affects our specific environment.

Attack Path

How an attacker could exploit the issue

An attacker can target this vulnerability by sending specially crafted network requests. This could lead to unexpected system termination or kernel memory corruption.

No authentication or privileges required.
Vulnerable component is the macOS kernel.
Risk of system termination or memory corruption.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could potentially cause unexpected system termination or corrupt kernel memory when supported by the advisory. This could impact the stability and integrity of the macOS operating system.

Kernel memory corruption and system termination risk.
Exploitation may occur over the network.
Unpredictable system behavior or instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the macOS operating system kernel, which is typically not directly exposed to the internet. Responsibility for addressing this issue likely lies with endpoint security or device management teams who are responsible for maintaining macOS systems. The immediate first step is to identify all macOS endpoints, confirm their business criticality, and then plan remediation according to risk, coordinating with Apple for updates.

Endpoint security and device management teams.
Verify macOS systems and business criticality.
Plan and coordinate OS updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is macOS, and how does it relate to this issue?

macOS is the operating system that powers Apple computers. This vulnerability specifically affects the kernel, which is the core component that manages hardware and system resources. Because the kernel sits at the foundation of the operating system, issues here can impact the stability and integrity of the entire machine.

What is the memory weakness found in CVE-2026-43790?

This vulnerability is classified as CWE-787, or Out-of-bounds Write. In plain terms, the software fails to properly manage memory boundaries, allowing data to be written into areas it should not access. This flaw in CVE-2026-43790 can lead to system crashes or the corruption of sensitive kernel memory.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted network requests to the target system. Notably, the vulnerability does not require the attacker to have authentication or special user privileges. However, simply using the computer for standard tasks like browsing or document editing does not trigger the bug; it requires specific, malicious network-based inputs.

Do I need to worry about internet exposure for my macOS devices?

According to Halo Surface Signal, this is very unlikely. While the bug is network-reachable in theory, the macOS kernel is a local operating system component, not an internet-facing service or edge gateway. Most macOS devices are not directly exposed to the public internet, which significantly reduces the risk of remote targeting.

How should I respond if I manage macOS systems?

Your first step is to perform an inventory of your macOS endpoints to identify which systems are running affected versions of the software. Once identified, coordinate with your team to plan and deploy the official updates provided by Apple, which resolve the memory handling issues at the kernel level.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.