CVE-2026-43776: Apple iPadOS

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

Affected products

• Apple iPadOS: before 26.6 (fixed in 26.6)
• Apple iPhone OS: before 26.6 (fixed in 26.6)
• Apple macOS: from 15.0, before 15.7.8 (fixed in 15.7.8); from 26.0, before 26.6 (fixed in 26.6)

Published 2026-07-27. Last modified 2026-08-17.