CVE-2026-43697 is an out-of-bounds read in macOS, which Apple's Golden Gate 27 notes place in SceneKit. Processing a maliciously crafted 3D file may trigger it. The record scores it 7.1 (High). Apple lists fixes in macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
Apple's security notes for macOS Golden Gate 27, released 14 September 2026, list this issue under SceneKit with the impact stated as an out-of-bounds read from a maliciously crafted 3D file. The record lists the fixes as macOS Golden Gate 27, macOS Sequoia 15.8 and macOS Tahoe 26.7, and links three Apple support pages. We read the Golden Gate 27 page only, so confirm the other two releases in their notes.
Source agreement: the record's 7.1 (High) is the only score available, since Apple does not publish scores. The record's vector is local with user interaction, high confidentiality and availability impact and no integrity impact.
Weakness class: CWE-125, out-of-bounds read.
How to check if you're exposed
On a Mac, choose the Apple menu, then About This Mac, and read the macOS version. You can also run sw_vers in Terminal. Then open System Settings, General, Software Update to see whether an update is waiting. For a fleet, your MDM or Jamf-style inventory can report the macOS version per device, and you can set a deadline for the update.
The affected versions are those older than the fixed releases above on each line. A Mac on Sequoia below 15.8, or Tahoe below 26.7, is affected.
What to do now
- Update managed Macs to macOS Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, depending on what each Mac supports.
- Set a software update deadline in your MDM, so users cannot defer indefinitely.
- Tell staff not to open unexpected 3D model files from email or messaging apps.
- Check other Apple platforms for matching updates, since the same frameworks often ship across macOS and iOS.
- Keep a list of Macs that cannot take Golden Gate 27 and are stuck on older lines.
Why it matters
An out-of-bounds read happens when software reads memory outside a buffer. It can leak data from memory, crash the process, or help an attacker defeat other protections. The record's impact is high for confidentiality and availability and none for integrity.
The trigger is a 3D file, handled by a system framework. Frameworks like SceneKit are used by many apps, including preview features, so a flaw in one can be reached in more ways than the app name suggests. The KEV flag is false and Apple's notes do not report exploitation. Treat this as normal, prompt patching.
Quick check
Does this need me to open a file?
Yes. Apple says processing a crafted 3D file may trigger it, and the record's vector needs user interaction.
Does Apple give a CVSS score?
No. The 7.1 is from the CVE record.
Sources
Last reviewed: 18 October 2026.
