CVE-2026-43763

Apple macOS (Apple Type Services) · Severity Medium (CVSS 5.5) · Discovered by Pavan Nallamothu

A permissions flaw in Apple Type Services (ATS) let a sandboxed process read files outside its container. Apple fixed the issue across macOS Tahoe, Sequoia, and Sonoma and assigned CVE-2026-43763.

Summary

Sandbox file-read via a permissions issue in Apple Type Services, fixed across macOS Tahoe 26.6 and 26.7, Sequoia 15.7.8 and 15.8, and Sonoma 14.8.8.

References

cve.org record · Apple: macOS Tahoe 26.6 · Apple: macOS Sequoia 15.7.8 · Apple: macOS Sonoma 14.8.8 · macOS Tahoe 26.7 · macOS Sequoia 15.8