CVE-2026-43813

HIGH

Apple Ios And iPadOS - Denial of Service

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-43813. PoCs published by EastArctica.

AI-analyzed exploit summary This repository provides an in-depth technical analysis of CVE-2026-43813, a code signing enforcement bypass in Apple's CloudAttestation.dylib. The writeup details the root cause (insufficient input validation in `PCC.ComputeNodeValidator.policy.getter`), patch diffs, and data flow analysis, demonstrating how a maliciously crafted `AttestationBundle` could manipulate an environment byte to influence policy validation.

Description

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement.

Exploits (1)

github WRITEUP
by EastArctica · poc
https://github.com/EastArctica/CVE-2026-43813

This repository provides an in-depth technical analysis of CVE-2026-43813, a code signing enforcement bypass in Apple's CloudAttestation.dylib. The writeup details the root cause (insufficient input validation in `PCC.ComputeNodeValidator.policy.getter`), patch diffs, and data flow analysis, demonstrating how a maliciously crafted `AttestationBundle` could manipulate an environment byte to influence policy validation.

Classification
Writeup 99%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: iOS 26.5 and earlier, iPadOS 26.5 and earlier, macOS Tahoe 26.5 and earlier, tvOS 26.5 and earlier, visionOS 26.5 and earlier, watchOS 26.5 and earlier
No auth needed
Prerequisites: Ability to craft a malicious `AttestationBundle` with a forged `darwinInit.secureCoding` dictionary · Access to a vulnerable Apple device or environment where `NodeValidator.validate(bundle:nonce:)` is called
mistral-large-3 · analyzed Jul 30, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 7.1
EPSS 0.0013
EPSS Percentile 2.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (11)
Apple/iOS and iPadOS < 26.6
apple/ipados < 26.6
apple/iphone_os < 26.6
Apple/macOS < 26.6
apple/macos 26.0 - 26.6
Apple/tvOS < 26.6
apple/tvos < 26.6
Apple/visionOS < 26.6
apple/visionos < 26.6
Apple/watchOS < 26.6
... and 1 more
Published Jul 27, 2026
Tracked Since Jul 28, 2026