CVE-2026-43789 is an access issue in macOS, which Apple's Golden Gate 27 notes place in CoreMedia. Apple says an app may be able to access user-sensitive data, and fixed it with additional sandbox restrictions. The record scores it 7.5 (High). Fixes are in Golden Gate 27, Sequoia 15.8 and Tahoe 26.7.
What's affected
Apple's security notes for macOS Golden Gate 27, released 14 September 2026, list this issue under CoreMedia: an access issue addressed with additional sandbox restrictions, where an app may be able to access user-sensitive data. The record lists the fixes as macOS Golden Gate 27, Sequoia 15.8 and Tahoe 26.7. We read only the Golden Gate 27 page, so confirm the other two in their notes.
Source conflict to note: Apple describes an app on the machine reaching sensitive data, which sounds local. The record's CVSS vector, though, is network, no privileges and no user interaction, with high confidentiality impact. Both are reported here. Apple does not publish scores, and the vector looks like a mismatch with Apple's description, so read the Apple notes for the real conditions.
Weakness class: CWE-862, missing authorization.
How to check if you're exposed
On a Mac, choose the Apple menu, then About This Mac, and read the macOS version. You can also run sw_vers in Terminal. Then open System Settings, General, Software Update to see whether an update is waiting. For a fleet, your MDM or Jamf-style inventory can report the macOS version per device, and you can set a deadline for the update.
Compare the result with the fixed releases: Sequoia 15.8, Tahoe 26.7 and Golden Gate 27. Macs on older builds in those lines are affected.
What to do now
- Update managed Macs to Sequoia 15.8, Tahoe 26.7 or Golden Gate 27, as each Mac supports.
- Set an update deadline in your MDM.
- Review which apps on managed Macs have privacy permissions such as camera, microphone and file access, and remove the ones you do not need.
- Allow software only from sources you trust, since this issue involves an app on the machine.
- Document Macs stuck on older lines and plan their replacement.
Why it matters
Sandboxes limit what an app can reach, and a sandbox escape or weakness lets an app do more than the user granted it. Apple says the fix adds restrictions to close an access path. The weakness class is missing authorization, meaning an operation that should have been gated by a check was not.
The practical issue is what apps on a Mac can see. A system service such as CoreMedia, which handles audio and video, runs with access that an ordinary app does not have, and the bug lets a sandboxed app borrow it. The KEV flag is false and Apple does not report exploitation here.
Quick check
Is this remote?
Apple's description says an app may be able to access data, which suggests a local app. The record's vector says network. We note the difference and defer to Apple's text.
Which versions fix it?
Golden Gate 27, Sequoia 15.8 and Tahoe 26.7, per the record and Apple's Golden Gate 27 notes.
Sources
Last reviewed: 18 October 2026.
