In macOS Tahoe 26.6, Apple addressed four security issues I had previously reported. The HFS+ issue was assigned CVE-2026-43773. Two mDNSResponder reports were closed under CVE-2026-43806, and Apple also resolved an issue affecting xar.

The reports demonstrated reproducible security impact. Apple awarded bounties for the HFS+ report and the mDNSResponder out-of-bounds-read report; both were addressed in macOS Tahoe 26.6.

Issues Addressed

CVE-2026-43773 — HFS+

Impact

Apple addressed a kernel heap-buffer-overflow in HFS+ with an arbitrary disk-write primitive, assigned CVE-2026-43773. A crafted USB disk image can trigger an out-of-bounds kernel read. My report also documented a disk-write primitive.

Proof of Concept

The following video demonstrates the PoC by inserting a crafted HFS+ USB disk into an affected Mac in a controlled environment:

CVE-2026-43773 PoC video

Watch the PoC on YouTube: https://www.youtube.com/watch?v=NSw_WHOT8d8

CVE-2026-43806 — mDNSResponder

Apple closed two mDNSResponder reports under CVE-2026-43806:

  • An out-of-bounds read leaking stale bytes and unicast-mDNS transaction IDs.
  • An out-of-bounds write allowing local corruption of global state.

Apple awarded a bounty for the out-of-bounds-read report.

xar Acknowledgment

Apple also resolved a vulnerability affecting xar in the same release.

Earlier in 2026, Apple also acknowledged my PPP out-of-bounds-read report in macOS Tahoe 26.5, released May 11, 2026.

Closing Notes

The Apple Security Bounty awards covered my AI subscriptions and the second-hand MacBook I recently bought for this research. Further technical details may be published in future.

References