An out-of-bounds write issue was addressed with improved input validation

CVE-2026-43745 is an *out-of-bounds write* (CWE-787) in WebKit, Apple's browser engine. A maliciously crafted web page can push WebKit past an allocation boundary and corrupt adjacent memory. Apple's own write-up describes the observable impact as an unexpected Safari crash — i.e., a denial-of-service outcome rather than confirmed code execution. Affected builds are macOS Tahoe, macOS Sonoma, macOS Sequoia, iOS/iPadOS, and standalone Safari prior to the 26.5.2 train (iOS 26.5.2 / iPadOS 26.5.2 / macOS Tahoe 26.5.2 / Safari 26.5.2). The bug was reported by OpenAI Codex Security (Amy Burnett, Khai Tran) — one of the AI-discovered WebKit bugs in Apple's June 2026 cycle.

The vendor's MEDIUM (6.5) label tracks reality. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H correctly captures a network-reachable, user-interaction-required *availability-only* impact. Apple has not (yet) re-scored this as a memory-corruption-to-RCE primitive, and there's no public exploit demonstrating C/I impact. A patient researcher might convert the OOB write into something heavier, but as documented today it is a crash. MEDIUM is fair.

Why this verdict

• Availability-only impact: vector says C:N/I:N/A:H — Apple's own analysis sees a crash, not a data-exfil or integrity primitive.
• UI:R requirement: zero-click is off the table; victim must load attacker content, which email and web gateways already filter.
• No exploitation signal: EPSS 0.003, not on KEV, no public PoC, discovered internally by an AI fuzzing team — the bug went from discovery to fix with no adversary involvement.
• Role multiplier: WebKit ships on (a) workstations / iPhones / iPads — DoS only per current scoring; (b) macOS servers running admin consoles in Safari — still just renderer crash; (c) WebKit-using apps with WKWebView (Mail, Slack helpers, Electron-ish wrappers) — same renderer sandbox, same containment. No high-value-role chain ends in fleet takeover with the documented primitive. Floor stays MEDIUM.
• Patch availability is clean: Apple shipped point releases (26.5.2) — no compensating-control gymnastics required, normal browser-update cadence handles it.

Why not higher?

Promotion to HIGH would require either a confirmed RCE chain (none exists), KEV listing (it isn't), or a high-value-role blast radius (WebKit's renderer sandbox + PAC contain the documented primitive). C:N/I:N is the killer signal — Apple specifically chose to score this as non-confidentiality-impacting.

Why not lower?

Downgrading to LOW would ignore that OOB writes in WebKit have repeatedly been chained into iOS implant payloads (Pegasus, Predator) by patient actors. The bug is real, network-reachable, and trivial-AC. MEDIUM with normal-cadence patching is the honest call; LOW would invite complacency.

1. Push Safari/iOS/iPadOS/macOS 26.5.2 via MDM — Jamf, Intune, Kandji, Mosyle — set the minimum-OS / minimum-Safari version to 26.5.2 and force-install. Deadline: this is a MEDIUM verdict, so the noisgate remediation SLA is 365 days, but for a browser bug the practical target is the next monthly patch ring (under 30 days).
2. Enable Apple's Lockdown Mode for high-risk users — Executives, journalists, dissidents, M&A counsel — Lockdown Mode strips down WebKit's attack surface significantly. Configure via Settings → Privacy & Security → Lockdown Mode, or push via Configuration Profile.
3. Block known-bad domains at the secure web gateway — Use threat-intel feeds in Zscaler/Netskope/Cisco Umbrella to drop access to active phishing infrastructure that could host triggering pages. Useful while patch deployment completes.
4. Tune EDR to alert on repeated WebContent crashes — Repeated com.apple.WebKit.WebContent crashes on one host = either bad ad inventory or active exploit attempt. CrowdStrike / SentinelOne / Defender for Endpoint can pattern-match the crash signature.

Run on the target macOS host as a normal user — no sudo required. Invoke as ./check-cve-2026-43745.sh. Reports VULNERABLE if Safari or macOS WebKit is below the 26.5.2 fix line.

#!/usr/bin/env bash
# noisgate check: CVE-2026-43745 (WebKit OOB write, fixed in 26.5.2 train)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

FIXED_SAFARI="26.5.2"
FIXED_MACOS_TAHOE="26.5.2"

ver_ge() {
  # returns 0 if $1 >= $2 (dot-separated version compare)
  [ "$1" = "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" ]
}

# 1. macOS version
MACOS_VER=$(sw_vers -productVersion 2>/dev/null || echo "")
# 2. Safari version (from bundle Info.plist)
SAFARI_PLIST="/Applications/Safari.app/Contents/Info.plist"
SAFARI_VER=""
if [ -f "$SAFARI_PLIST" ]; then
  SAFARI_VER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "$SAFARI_PLIST" 2>/dev/null || echo "")
fi

echo "macOS:  ${MACOS_VER:-unknown}"
echo "Safari: ${SAFARI_VER:-unknown}"

VULN=0
UNKNOWN=0

if [ -n "$SAFARI_VER" ]; then
  if ver_ge "$SAFARI_VER" "$FIXED_SAFARI"; then
    echo "Safari: OK (>= $FIXED_SAFARI)"
  else
    echo "Safari: VULNERABLE (< $FIXED_SAFARI)"
    VULN=1
  fi
else
  UNKNOWN=1
fi

# Tahoe-class build check (26.x)
if [ -n "$MACOS_VER" ]; then
  case "$MACOS_VER" in
    26.*)
      if ver_ge "$MACOS_VER" "$FIXED_MACOS_TAHOE"; then
        echo "macOS Tahoe: OK (>= $FIXED_MACOS_TAHOE)"
      else
        echo "macOS Tahoe: VULNERABLE (< $FIXED_MACOS_TAHOE)"
        VULN=1
      fi
      ;;
    14.*|15.*)
      # Sonoma / Sequoia — confirm WebKit backport package presence
      echo "macOS pre-Tahoe: confirm Safari $FIXED_SAFARI is installed (handled above)"
      ;;
    *)
      echo "macOS version not recognized — manual review"
      UNKNOWN=1
      ;;
  esac
fi

if [ $VULN -eq 1 ]; then
  echo "RESULT: VULNERABLE"
  exit 1
fi
if [ $UNKNOWN -eq 1 ]; then
  echo "RESULT: UNKNOWN"
  exit 2
fi
echo "RESULT: PATCHED"
exit 0

Sources

1. Apple — About the security content of Safari 26.5.2
2. Apple — About the security content of macOS Tahoe 26.5.2
3. Apple — About the security content of iOS 18.6.2 and iPadOS 18.6.2
4. Apple — About the security content of macOS Sonoma 14.7.8
5. The Hacker News — Apple Patches 30+ iOS/macOS/Safari Flaws, AI-Discovered WebKit Bugs
6. SecurityAffairs — Apple Fixes WebKit Flaws With Help From AI Tools
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS Model